Your Inbox Is Your Bottleneck

In January 2026, the curl project ended its bug bounty. It had run since April 2019 and produced 87 confirmed vulnerabilities, with over $100,000 paid to researchers.¹ Starting February 1, reports moved to GitHub's private vulnerability reporting, with no rewards attached.¹

The headline most people took away was that bug bounties are dying. That is not what happened, and the actual story is considerably more useful to anyone thinking about how their organization receives security reports.

Then the Flood

curl's intake ran for years on a stable ratio. North of 15% of submitted reports turned out to be confirmed vulnerabilities.¹ That is a healthy rate for a public program. Most reports are duplicates, non-issues, or good-faith misunderstandings of what constitutes a vulnerability.

Starting in 2025, that ratio collapsed to below 5%.¹ The cause was familiar: AI made it nearly free to produce a report that reads like a real one. The project's maintainers were spending their time debunking fabrications instead of fixing software.

Killing the bounty worked. The slop stopped. The volume did not.

By March, curl had moved reporting back to HackerOne after finding GitHub's tooling insufficient.² And by April, Stenberg was describing a different landscape entirely. The junk was gone. Nearly every report showed signs of AI assistance, and most were high quality. The confirmed-vulnerability rate climbed back past its pre-AI level. The report frequency roughly doubled from 2025, which had already doubled from the years before.³ He named the new era himself: high-quality chaos.³

Then in June, the project announced it would accept zero vulnerability reports for the month of July. Submissions paused July 1 and reopened August 3.⁴ Real reports, arriving faster than a small team could responsibly read them, buried a project that had already solved its junk problem. Not spam. Volume.

This was not a curl-specific quirk. Stenberg polled other maintainers and got the same story back from projects including Firefox, git, glibc, the Linux kernel, Django, and Wireshark.³ HackerOne's own Internet Bug Bounty paused new submissions in March.

The Cost of Being Correct

Here is the thing worth sitting with.

AI pushed the cost of producing a credible vulnerability report close to zero. In parallel, the cost of triaging one did not move at all. Validation still requires a human in the loop: someone to reproduce the finding, judge its severity, trace when it was introduced, and decide what happens next. One side of the pipeline got automated. The other side is still a person reading carefully.

That asymmetry does not resolve when report quality improves. It gets worse. A fabricated report can be dismissed in minutes. A technically accurate, well-reasoned report takes an hour or more to work through properly, and it deserves that hour. curl expects to publish close to 50 CVEs in 2026, potentially a record year, produced by the same volume that forced a month-long pause.³

The bounty was an amplifier, not the cause. Removing the money cut the incentive to submit noise. It did nothing about the underlying economics of reading.

The Queue Remembers

It would be easy to read this as maintainers complaining about researchers. It is not, and the framing matters.

Every unvalidated report that lands in a queue makes the next real one get read slower and with more suspicion. It trains the person on the other end to treat the inbox as a burden rather than a resource. This is the same pattern as alert fatigue anywhere else in security. A team that gets paged on everything eventually trusts nothing, and the real incident pays the price.

The dividing line is not AI versus human. Stenberg's own data shows AI-assisted reports driving the confirmed-vulnerability rate above its pre-AI level.³ The line is whether a finding was validated by the person submitting it before it consumed an hour of someone else's.

A program that can triage quickly, respond predictably, and tell a researcher plainly where their report stands is a program researchers want to submit to. That is not in tension with what maintainers need. It is the same thing described from the other side.

The Quietest Inboxes in Security

Most nonprofits are not living through curl's problem. As we dissected in An Absent Standard, and it is the reason we built Harbor Project in the first place, most are not receiving any reports at all. In our survey of 750 U.S. nonprofits, 1.3% published any way to report a security vulnerability. Below $50 million in revenue, we found no human-readable disclosure policies at all.⁵

So the sector is not behind on this problem. It is standing directly in front of it.

Consider what the curl data actually describes. The tooling that doubled report volume across the open source ecosystem does not distinguish a C library from a donation platform or a client portal. It scans what it is pointed at. As that capability spreads from dedicated researchers to anyone running an agent against a website, findings will surface on nonprofit systems whether or not anyone asked. The only question is where those findings go: to a published channel the organization controls, to a general inbox nobody monitors, to a public post, or nowhere at all while the flaw sits exposed.

The organizations learning about intake right now are learning it under load, with a queue already backed up. A nonprofit opening a disclosure channel today gets to design the intake before the volume arrives. That is an unusual advantage, and it has a shelf life.

When We Talk About Doors

The baseline has moved. A monitored email address in a security.txt file was adequate advice three years ago. It is thinner advice today, because the address was never the constraint. The constraint is the reading: the human hours spent validating whatever arrives.

A disclosure channel built to last needs:

A submission bar. Ask for reproduction steps and a working proof of concept as a condition of review. This is not hostile to researchers. It is the clearest signal separating validated work from speculation, and it costs a serious reporter nothing.

A triage layer. Someone or something that sorts before a human reads in depth. Duplicates, out-of-scope submissions, and raw scanner output should not land in the same queue as a reproduced finding.

Published response expectations. How fast a reporter hears back, and what the stages are. Ambiguity drives good researchers away more reliably than low payouts do.

Safe harbor language. A clear statement that the organization will not pursue legal action against good-faith reporting. For many researchers this determines whether they file at all.

A VDP before a bounty. Money raises volume. If intake cannot handle the volume it already has, paying for more of it is the wrong order of operations. curl's year is the argument for that sequence, not against paying researchers.

Redux

Follow what curl actually did across twelve months. It ended the bounty. It moved reporting to GitHub. It moved back to HackerOne when GitHub fell short. It paused for five weeks when the volume outran the team, told everyone exactly when it would reopen, and reopened on schedule. Stenberg's own verdict on the pause: possibly the project's best decision in a long while, with the backlog returned to normal levels within weeks.⁶

At no point did one of the most widely deployed pieces of software on the internet decide it no longer wanted to hear about its vulnerabilities. It changed how reports come in and how they get handled once they arrive. The question was never whether to have a front door. It is whether anyone is behind it.

For 98.7% of the nonprofit sector, there is no door to be behind.

---

Harbor Project builds vulnerability disclosure and bug bounty programs for mission-driven organizations, including the triage layer that sits between a report arriving and a person reading it.

References

1. Daniel Stenberg, "The end of the curl bug-bounty," daniel.haxx.se, January 26, 2026.
2. Daniel Stenberg, "curl security moves again," daniel.haxx.se, February 25, 2026.
3. Daniel Stenberg, "High-Quality Chaos," daniel.haxx.se, April 22, 2026.
4. Daniel Stenberg, "curl summer of bliss," daniel.haxx.se, June 15, 2026.
5. Harbor Project, "An Absent Standard," August 2026.
6. Daniel Stenberg, "What the bliss taught us," daniel.haxx.se, August 3, 2026.