GoKawiilCurl's bug bounty program shuts down amid flood of low-quality AI-generated reports
Curl ended its paid bug bounty program on January 31, 2026, after maintainer Daniel Stenberg said the share of genuine vulnerabilities in submissions dropped from above 15% to below 5% starting in 2025. Over its run, the program had confirmed 87 vulnerabilities and paid out more than $100,000. Google has separately paused supply-chain bounty submissions, though its broader vulnerability rewards programs paid $17.1 million in 2025.