The end of the #curl bug-bounty

[bagder@mastodon.social]

The end of the #curl bug-bounty

https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/

[addison@nothing-ever.works]

@bagder@mastodon.social RIP, it was probably one of the best

[poolitzer@mastodon.social]

@bagder small grammar/rewrite wording issue in the PR section: "I believe for PRs we have better much means to sort out the weed with automatic means, since we have tools, tests and scanners to verify such contributions."

[bagder@mastodon.social]

@poolitzer thanks, fixing!

[addison@nothing-ever.works]

@bagder@mastodon.social Oh, actually related: the IBB HackerOne listing still lists curl, should this be removed from the IBB listings as well? https://hackerone.com/ibb/policy_scopes

[bagder@mastodon.social]

@addison I believe it will be removed by the end of January when this officially goes into effect

[poolitzer@mastodon.social]

@bagder happy to help. Now I can claim to have bug fixed curl.

...

Sort of

[addison@nothing-ever.works]

@bagder@mastodon.social Gotcha, just wanted to ask to make sure since they were listed separately.

[coldclimate@hachyderm.io]

@bagder great write up. Thanks for all you do

[bagder@mastodon.social]

The bugbounty crash of 2025 in a single image (from the blog post)

[ulveon@derg.social]

@bagder@mastodon.social hey Daniel, I'm curious, were you financing the bug bounty payouts by yourself?

[bagder@mastodon.social]

@ulveon no, the IBB did that

[poolitzer@mastodon.social]

@bagder talking about graphs maybe one showing the payout per month/year might be nice?

"The bugbounty cash"

[bagder@mastodon.social]

@poolitzer https://curl.se/dashboard1.html#bug-bounty

[bagder@mastodon.social]

@poolitzer there's also this

[fre@infosec.exchange]

@bagder

Charging people money in an International context is complicated and a maintenance burden.

I think if it does come to this, you might consider requiring a small donation to a charity? This would dramatically reduce the hassle on all sides, and do something good as a bonus.

[bagder@mastodon.social]

@fre receiving money for vulnerability *reports* would not mean that we ship vulnerabilities though...

[fre@infosec.exchange]

@bagder of course not, but I guess someone could spin it like "they now have incentive to publish buggy code", right? Anyway, that wasn't the point of the post and I didn't want to insinuate any bad intentions, sorry. I'll remove that part.

[nini@oldbytes.space]

@bagder Is the header image for the blogpost AI generated?

[bagder@mastodon.social]

@nini to illustrate the point of the blog post, I should probably just say: maybe, maybe not. =)