nixCraft 馃惂 @nixCraft@mastodon.social
Public

curl, which is one of the most popular CLI/API tools for network requests and data transfer on Linux/Unix, is to discontinue its HackerOne bug bounty program due to "too strong incentives to find and make up 'problems' in bad faith that cause overload and abuse".

The authors simply cannot keep up with LLM-generated fake security reports created to collect money using bots. So, it now shuts down at the end of January 2026. This is why we can't have good things

github.com/curl/curl/pull/20312

Remove mentions of the bounty and hackerone. There will be more mentions, blog posts, timings etc in the coming weeks.

BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026 by bagder 路 Pull Request #20312 路 curl/curl

Remove mentions of the bounty and hackerone. There will be more mentions, blog posts, timings etc in the coming weeks.

github.com 路 GitHub

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://mastodon.social/users/nixCraft/statuses/115910328009783851 on your instance and quote it. (Note that quoting is not supported in Mastodon.)