romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-14 22:51:53 +03:00
Code Issues Projects Releases Packages Wiki Activity

BUG-BOUNTY.md: minor rephrase to say there is no bug bounty

Browse source 
also add a brief mention to VULN-DISCLOSURE-POLICY.md

Closes #20878
This commit is contained in:
Daniel Stenberg 2026-03-10 17:10:37 +01:00
parent a4f90969ff
commit ed7bf43a08
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/BUG-BOUNTY.md
View file

@ -4,13 +4,11 @@ Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
SPDX-License-Identifier: curl SPDX-License-Identifier: curl
--> -->
# The curl bug bounty # No curl bug bounty
Up until the end of January 2026 there was a curl bug bounty. It is no more.
The curl project does not offer any rewards for reported bugs or The curl project does not offer any rewards for reported bugs or
vulnerabilities. We also do not aid security researchers to get such rewards vulnerabilities. We do not aid security researchers to get such rewards for
for curl problems from other sources either. curl problems from other sources.
A bug bounty gives people too strong incentives to find and make up "problems" A bug bounty gives people too strong incentives to find and make up "problems"
in bad faith that cause overload and abuse. in bad faith that cause overload and abuse.

3
docs/VULN-DISCLOSURE-POLICY.md
View file

@ -9,6 +9,9 @@ SPDX-License-Identifier: curl
This document describes how security vulnerabilities are handled in the curl This document describes how security vulnerabilities are handled in the curl
project. project.
There is no bug bounty and the curl project never offers rewards for reported
vulnerabilities.
## Publishing Information ## Publishing Information
All known and public curl or libcurl related vulnerabilities are listed on All known and public curl or libcurl related vulnerabilities are listed on

1
scripts/mdlinkcheck
View file

@ -40,7 +40,6 @@ my %whitelist = (
'https://curl.se/dev/secprocess.html' => 1, 'https://curl.se/dev/secprocess.html' => 1,
'https://curl.se/dev/sourceactivity.html' => 1, 'https://curl.se/dev/sourceactivity.html' => 1,
'https://curl.se/docs/' => 1, 'https://curl.se/docs/' => 1,
'https://curl.se/docs/bugbounty.html' => 1,
'https://curl.se/docs/caextract.html' => 1, 'https://curl.se/docs/caextract.html' => 1,
'https://curl.se/docs/copyright.html' => 1, 'https://curl.se/docs/copyright.html' => 1,
'https://curl.se/docs/http-cookies.html' => 1, 'https://curl.se/docs/http-cookies.html' => 1,