From f868b09d78d0125d03fa92612a9c6e8741c90006 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Thu, 22 Jan 2026 09:48:42 +0100 Subject: [PATCH] fixup BUG-BOUNTY.md to say less "no longer" --- docs/BUG-BOUNTY.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/docs/BUG-BOUNTY.md b/docs/BUG-BOUNTY.md index ed41668514..8a85096e09 100644 --- a/docs/BUG-BOUNTY.md +++ b/docs/BUG-BOUNTY.md @@ -8,12 +8,11 @@ SPDX-License-Identifier: curl Up until the end of January 2026 there was a curl bug bounty. It is no more. -The curl project no longer offers any rewards for reported bugs or +The curl project does not offer any rewards for reported bugs or vulnerabilities. We also do not aid security researchers to get such rewards for curl problems from other sources either. -We have concluded the hard way that a bug bounty gives people too strong -incentives to find and make up "problems" in bad faith that cause overload and -abuse. +A bug bounty gives people too strong incentives to find and make up "problems" +in bad faith that cause overload and abuse. We still appreciate and value valid vulnerability reports.