daniel.haxx.se

daniel.haxx.se is the personal blog of Daniel Stenberg, the founder and lead developer of curl and libcurl. The site serves as a place for him to write about curl development, security practices, and open source maintenance, and it is aimed at developers, security researchers, and anyone interested in the inner workings of widely used open source software.

The core content of this post is a policy change for curl’s vulnerability disclosure program. Starting October 26, 2026, reports deemed LOW or MEDIUM severity must be submitted as public GitHub issues, while only HIGH or CRITICAL vulnerabilities remain private in the HackerOne tracker. Researchers unsure about severity can still submit to HackerOne for assessment, and LOW or MEDIUM reports there will be asked to move to GitHub and closed as informative.

The change is driven by the sheer volume of incoming reports, over 90% of which are quickly assessed as below HIGH severity. By making minor reports public, the project aims to reduce tracker load and keep the private process focused on serious issues. The post is most relevant to security researchers who report curl vulnerabilities and to contributors who follow curl’s development and security policies.

Readers should note the effective date and the severity thresholds when preparing a report. For minor issues, filing a GitHub issue is now the expected path; for serious ones, HackerOne remains the private channel. Overall, the post documents a practical adjustment to ope