Starting October 26, curl wants vulnerability reports it deems LOW or MEDIUM filed as ordinary GitHub issues, public from the first message. Only HIGH and CRITICAL stay private on HackerOne, and the private channel is no refuge for misfilings either: a below-HIGH report sent there “will be requested to be resubmitted on GitHub and will be closed as informative on HackerOne (and publicly disclosed).” Daniel Stenberg’s accounting of why: “Over the last few years, over 90% of all submissions could quickly be assessed to be less than HIGH.” The private channel was carrying a queue that was more than ninety percent LOW or MEDIUM by the project’s own rating.

The driver is volume with a specific mechanism. “All key maintainers feel strained, overloaded and brought to the brink of what we can muster. We must act to survive.” The flood feeds itself: “the moment we announce a new set of CVEs and their associated fixes, there is an army of AI-using researchers who throw all those at their models and harnesses to find similar mistakes or omissions in the fixes.” Announcements seed the next wave, and many of the new reports, in his accounting, are models generating “crazy sequences or option combinations” that are unlikely to ever be used in the real world. His verdict on those reports: “We save no users by insisting on doing the CVE dance for those issues. We only get work for ourselves and a whole world that has to act on them.”

When Pop!_OS banned generated content from its trackers and GNOME’s security maintainer answered that this “might as well” ban all vulnerability reports, the fork turned on what a refusal costs: a declined pull request costs a project nothing, while a refused report doesn’t refuse the bug. curl is the project that tried to price that refusal and found it unavailable. As a CVE Numbering Authority it can decline to number a real flaw, but “within the CVE program there is an appeals process and if we don’t hand out a CVE to an actual vulnerability, then someone else will do it.” A ban doesn’t delete the bug or even the report; it hands the numbering to someone with less context. What curl controls is the channel reports arrive in, so the channel is what moved.

What the move buys is narrower than it sounds. “The amount of work needed per received vulnerability report does not shrink by doing them in public,” Stenberg writes. What changes is who can share it: distros and users “keep up with security fixes earlier and better,” and the scrutiny the AI army was already running after each release, hunting omissions in the fixes, now happens in the open before the release, where its findings help instead of flooding the inbox. He names the costs plainly too: public LOW and MEDIUM issues give bad actors “a slightly longer window of opportunity,” unfortunate and unavoidable, and the risk of a HIGH arriving mislabeled as LOW he waves off as “basically unheard of.” The gradient already existed on curl’s side: the policy has long allowed LOW and MEDIUM fixes to merge via a normal PR without mentioning security, and all reports, “valid or not,” were already supposed to be disclosed once the advisory shipped. The new policy moves the publicity from the end of the pipeline to the intake.

The one artifact not caught up is the policy page itself: last modified the day before the announcement, it still instructs reporters that “Security vulnerabilities should not be entered in the project’s public bug tracker” and that “a bug tracker entry must NOT be created,” with no mention of the October 26 split. It does carry a paragraph asking reporters to write “briefly and clearly in your own human voice” and not “lazily paste massive, AI-generated explanations,” so the flood had already been asked for better prose before the channel was moved. I filed no report and ran no scanner against curl; every number above is Stenberg’s. His scope line reaches past curl: “I believe few software projects can stand this kind of prolonged high volume deluge for extended periods. Something needs to give way.” At curl, the first thing to give way is the privacy of the minor report.