this makes me really upset

Quick Overview

The creator of curl, Daniel Stenberg, discontinued the project's HackerOne bug bounty program due to "too strong incentives to find and make up 'problems' in bad faith that cause overload and abuse," leading to an increase in low-quality 'slop' reports, particularly those generated by AI.

Key Points: Daniel Stenberg discontinued the curl project's HackerOne bug bounty program, effective January 31, 2026. The primary reason cited was the influx of low-quality, bad-faith security reports, termed 'slop,' which caused overload and abuse. Stenberg explicitly blamed an 'explosion in AI slop reports' starting in late 2024 for accelerating the decline of the program's value. The program had successfully paid out over $100,000 USD for 87 confirmed vulnerabilities across curl and libcurl since its inception in April 2019. Stenberg highlighted that reporters often tried to twist findings into critical vulnerabilities rather than actively contributing fixes. The actions taken include stopping monetary rewards for security reports and ceasing use of HackerOne as the recommended reporting channel for security issues.

Context: The video discusses the decision by Daniel Stenberg, the CEO and primary maintainer of the widely used curl project (and libcurl), to end its bug bounty program hosted on HackerOne. This decision stems from increasing frustration with the quality of submissions received through the platform, particularly citing the negative impact of AI-generated reports ('slop') overwhelming the maintenance team's capacity to handle legitimate security issues.

Detailed Analysis

Daniel Stenberg decided to discontinue curl's HackerOne bug bounty program on January 31, 2026, citing overwhelming 'slop' reports, many of which he attributes to AI tools like ChatGPT generating low-quality submissions in bad faith. He notes that while the program was successful initially, paying out over $100,000 for 87 confirmed vulnerabilities since 2019, the recent environment has become toxic. Stenberg outlines three main bad trends: mind-numbing AI slop, humans doing worse than AI by trying to twist minor issues into critical ones, and an apparent will to poke holes rather than help. Consequently, curl will no longer offer monetary rewards for security reports and will stop using HackerOne as the recommended channel for reporting security issues, instead directing users to mailing lists or GitHub for security advisories. Stenberg contrasted this situation with recent positive developments, such as receiving the European Open Source Achievement Award, highlighting the irony of the positive recognition alongside the security reporting frustrations. He also briefly reviewed complex vulnerabilities found in curl and libcurl, like a Use-After-Free in libcurl and buffer overflows in curl's IP conversion functions, which were found through manual auditing, suggesting AI tools still struggle with complex, real-world issues.