64824e439d
Daniel Stenberg
2026-05-18
Subject
VULN-DISCLOSURE-POLICY.md: test code is not secure
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
docs/VULN-DISCLOSURE-POLICY.md+8 -0
| @@ -254,6 +254,14 @@ security problems. | |
| The same applies to scripts and software which are not installed by default | |
| through the make install rule. | |
| + | ## Test code |
| + | |
| + | curl has an extensive test suite with lots of code written specifically to |
| + | exercise and verify curl, libcurl and specific internal functions. The test |
| + | code and its associated test servers are *not* intended for production use. |
| + | They are not secure, you should not assume otherwise and must not report about |
| + | security problems in those. |
| + | |
| ## URL inconsistencies | |
| URL parser inconsistencies between browsers and curl are expected and are not | |