# curl: vulnerability disclosure program on HackerOne

> curl is a vulnerability disclosure program on HackerOne. It does not pay bounties. It received 158 reports in the 90 days to November 7, 2026, about 158 per in-scope asset.

- **Company:** curl
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/curl
- **Pays bounties:** no
- **Submissions:** open
- **Launched:** April 22, 2019
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/curl

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

- Reports received in the last 90 days: 158 (about 158 per in-scope asset)
- Researchers participating: 69
- Response efficiency: 100%
- First-response target: 1 day
- Triage target: 8 days
- Bounty target: 100 days
- Barriers: bounty amounts hidden

## Scope

As imported from HackerOne on November 4, 2026: 1 assets in scope (0 bounty-eligible), 0 out of scope. The policy page is the authority.

- `https://github.com/curl/curl` (SOURCE_CODE): in scope, no bounty, max severity critical

## Recent public accepted findings

- November 3, 2026: low severity
- October 27, 2026: low severity
- October 26, 2026: medium severity
- October 26, 2026: low severity
- October 26, 2026: medium severity

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.