ed7bf43a08
Daniel Stenberg
2026-03-10
Subject
BUG-BOUNTY.md: minor rephrase to say there is no bug bounty
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
docs/BUG-BOUNTY.md+3 -5
| @@ -4,13 +4,11 @@ Copyright (C) Daniel Stenberg, <[email protected]>, et al. | |
| SPDX-License-Identifier: curl | |
| --> | |
| - | # The curl bug bounty |
| - | |
| - | Up until the end of January 2026 there was a curl bug bounty. It is no more. |
| + | # No curl bug bounty |
| The curl project does not offer any rewards for reported bugs or | |
| - | vulnerabilities. We also do not aid security researchers to get such rewards |
| - | for curl problems from other sources either. |
| + | vulnerabilities. We do not aid security researchers to get such rewards for |
| + | curl problems from other sources. |
| A bug bounty gives people too strong incentives to find and make up "problems" | |
| in bad faith that cause overload and abuse. | |
docs/VULN-DISCLOSURE-POLICY.md+3 -0
| @@ -9,6 +9,9 @@ SPDX-License-Identifier: curl | |
| This document describes how security vulnerabilities are handled in the curl | |
| project. | |
| + | There is no bug bounty and the curl project never offers rewards for reported |
| + | vulnerabilities. |
| + | |
| ## Publishing Information | |
| All known and public curl or libcurl related vulnerabilities are listed on | |
scripts/mdlinkcheck+0 -1
| @@ -40,7 +40,6 @@ my %whitelist = ( | |
| 'https://curl.se/dev/secprocess.html' => 1, | |
| 'https://curl.se/dev/sourceactivity.html' => 1, | |
| 'https://curl.se/docs/' => 1, | |
| - | 'https://curl.se/docs/bugbounty.html' => 1, |
| 'https://curl.se/docs/caextract.html' => 1, | |
| 'https://curl.se/docs/copyright.html' => 1, | |
| 'https://curl.se/docs/http-cookies.html' => 1, | |