curl project to make low and medium vulnerability reports public

The curl project has announced a significant change to its vulnerability disclosure process. Starting October 26, 2026, all vulnerability reports classified as LOW or MEDIUM severity will be published as public issues in the project's GitHub repository.

Only vulnerabilities categorized as HIGH or CRITICAL will remain private via the HackerOne platform. Project maintainer Daniel Stenberg noted that over 90% of recent submissions have been assessed as less than HIGH severity. This shift is part of a survival strategy to manage an overwhelming volume of vulnerability reports that has left key maintainers strained and overloaded.

By moving these reports to GitHub, the project aims to allow the broader community to assist in assessing reports, understanding vulnerabilities, and developing fixes. This transparency is intended to help prevent errors in patches and manage the increasing influx of reports, including those generated by researchers using AI tools to find similar mistakes in recent fixes.