Do Son 
The open-source project cURL announced a significant restructuring of its triage workflow. Starting October 26, 2026, researchers must submit low and medium severity vulnerability reports directly to public GitHub issues. Conversely, high and critical vulnerabilities will remain confidential disclosures. Maintainers will continue processing severe reports through the cURL HackerOne bug bounty program.
How the Dual-Track Disclosure Workflow Operates
Under the revised workflow, security researchers should evaluate potential flaws before submission. Researchers can then route their findings according to standard severity ratings. However, analysts who feel uncertain about vulnerability impact may still use private reporting channels. In those instances, maintainers will review the submission. If the team determines the flaw is low or medium risk, they will convert it into a public GitHub issue.
Historically, the project categorizes vulnerabilities across four distinct tiers. Lead developer Daniel Stenberg noted that over 90% of past submissions were low or medium severity. Consequently, only a tiny fraction of reports qualified as high or critical security risks.
Alleviating Maintainer Fatigue and AI Report Influx
Project maintainers introduced this structural change to alleviate acute review fatigue. Recently, the volume of automated vulnerability reports has expanded rapidly. Specifically, automated AI auditing tools often test obscure command options. These scanners frequently flag theoretical edge cases that rarely occur within real-world production environments.
As a result, maintainers spend extensive hours verifying questionable claims. The team must analyze whether a bug affects real systems, design remedies, and draft formal security advisories. Therefore, shifting minor bugs to GitHub distributes the evaluation burden across the broader open-source community.
Community Collaboration Versus Early Exposure Risks
Furthermore, public triage enables external developers to verify reproductions and suggest code improvements. Linux distributions and system administrators also gain earlier visibility into upcoming fixes.
Nevertheless, this transparency introduces definite operational tradeoffs. Because flaws become public immediately, malicious actors can inspect code weaknesses before formal patches arrive. Despite this risk, maintainers believe public collaboration offers a healthier balance for open-source sustainability.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
