curl Vulnerability Disclosure
Coordinated disclosure for curl and libcurl. The project states that it does not pay rewards.
Tags: disclosure, opensource, hackerone
- Program model
- Coordinated disclosure
- Regions
- Global
- Payout
- No rewards
Specialties: opensource, library
How to approach it
Scope first: curl and libcurl releases, not unrelated products that happen to ship curl. The policy says to report on HackerOne and not by email.
- Read the policy list of issues that are not vulnerabilities before you file.
- Write the report in your own words. The policy asks for a clear human explanation.