curl will move vulnerability reports rated Low or Medium into public GitHub issues, Daniel Stenberg announced in an October 20 post. The change takes effect on October 26, 2026. It opens those investigations to outside contributors before fixes ship, while High and Critical reports remain private on HackerOne.
Stenberg attributes the decision to report overload, including AI-assisted findings with little practical risk. He hopes public assessment will spread the workload. Each report still needs investigation.
Where a researcher should report
The announcement keeps HackerOne available for researchers unsure of severity. The team can assess the finding before directing lower-severity reports to GitHub.
curl's severity guidelines distinguish Low issues by how difficult or unlikely they are to trigger. Medium issues are easier to trigger but usually need another condition to become serious. High issues have direct, practical impact and are not difficult to exploit. curl avoids numerical vulnerability scores.
For a reporter, that makes a reproducible failure only part of the submission. Explain the configuration required and what an attacker can actually achieve. Those details help maintainers place the report on the project's severity scale.
Earlier visibility carries an exposure cost
Stenberg acknowledges that public investigations give attackers more time. Whether wider participation saves maintainer time remains unmeasured in the announcement.
There is also a documentation transition to follow. When checked on October 21, the disclosure policy page still told researchers to keep security reports out of the public tracker. The dated announcement specifies the coming exception by severity. It doesn't authorize public submission of every suspected flaw.
Watch for the policy page to reflect the October 26 change. Researchers facing uncertain severity can still seek a private assessment.