# Curl Maintainers Shift Low-Severity Vulnerability Reporting to Public GitHub Project leaders move minor security flaws to public view to manage overwhelming submission volumes. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/f1780564-dd65-42b8-a1de-87e3b4992466 ## Shift to Public Disclosure Starting October 26, curl will move all low and medium-severity vulnerability reports to its public GitHub repository. Maintainer Daniel Stenberg initiated this policy to manage an unsustainable flood of incoming reports. High and critical flaws will continue to be handled through private channels to ensure necessary security and remediation protocols. ## The AI Submission Surge The project faces a significant increase in reports, largely driven by AI-generated submissions. These reports often highlight unusual option combinations that are unlikely to occur in real-world applications. Stenberg noted that over 90 percent of recent submissions were assessed as less than high severity, yet they consume critical maintainer bandwidth. ## Operational Survival Strategy Stenberg described the current workload as a survival struggle, noting that key maintainers are strained and overloaded. The decision to shutter the bug bounty program earlier this year was the first step in this strategy. This new policy aims to prevent project burnout while maintaining the integrity of the data transfer tool. ## Public Assessment Benefits By moving minor reports to the public, the project hopes to distribute the assessment load among more contributors. This approach allows the community to assist in developing fixes, writing advisories, and checking for related problems before official releases. It shifts the burden from a few core maintainers to a broader developer base. ## Security Risk Trade-offs Public disclosure inherently provides attackers with more time to exploit flaws before patches are finalized. Stenberg acknowledges this risk but deems it unavoidable given the current volume of reports. By limiting this practice strictly to non-critical issues, the team attempts to balance security exposure against the necessity of project sustainability. ## Filtering Through HackerOne Security researchers who are uncertain about the severity of their findings can still submit reports via HackerOne. The maintainers will then categorize the report to determine if it qualifies for private handling or must be moved to the public repository. This gatekeeping mechanism helps maintain some control over the incoming stream. ## Documentation and Lessons Handling reports publicly makes the resulting lessons and documentation easier for the community to access. Stenberg believes that while the work per report does not decrease, the transparency could improve overall project knowledge. This shift reflects a broader trend where open source projects must adapt to automated, high-volume security reporting. ## Future Project Sustainability The maintainers do not anticipate the current flood of reports to decrease within the next several months. Stenberg warns that few software projects can withstand such a prolonged, high-volume deluge without changing their operational model. This policy change represents a necessary evolution in how critical open source infrastructure manages security maintenance. ## Sources covering this story - https://www.theregister.com/security/2026/10/20/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche/5304198 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._