In 2025 so far, #curl has received 32 security vulnerability reports.
Out of those, two were confirmed genuine vulnerabilities. The latest one submitted January 23.
Six of them were AI slop (some of the others might as well be, but it isn't always easy to tell).
Ten of them we classified as "normal bugs" and took care of the normal way.
As a general rule, we spend several man hours on every incident but we don't actually track nor measure that.