curl to Make Low and Medium Severity Vulnerability Reports Public from October 2026

Starting 26 October 2026, the curl project will route vulnerability reports rated LOW or MEDIUM to its public GitHub issue tracker, while HIGH and CRITICAL reports will remain private on HackerOne. Maintainer Daniel Stenberg says over 90 percent of submissions in recent years have been rated below HIGH, creating a heavy workload for a small team. Many of these reports come from AI-assisted discovery of unusual input combinations that Stenberg believes rarely occur in real applications. The project has said its maintainers are overloaded and that it must change its approach to survive, and it expects the volume not to decline in the coming months. The change conflicts with the project's published disclosure policy page, which still describes a fully private process.