After six years and 500+ reports to the #curl bug-bounty, the stats that might be the coolest:
Average time to first response: 1h
Median time to first response: 0h
I read this like we replied to more than half of the reports within 30 minutes.
(and yeah, maybe HackerOne should offer higher time resolution)