curl maintainer Daniel Stenberg says the project will require LOW- and MEDIUM-severity vulnerability reports to be submitted as public GitHub issues starting October 26, while HIGH and CRITICAL reports will remain private in HackerOne. He attributes the change to an avalanche of reports, many quickly assessed as low severity, and says a public process may distribute assessment work across the community, while acknowledging that it can give attackers a longer window to exploit a reported issue.
Do minor curl vulnerabilities in the open
curl maintainer Daniel Stenberg says the project will require LOW- and MEDIUM-severity vulnerability reports to be submitted as public GitHub issues starting October 26, while HIGH and CRITICAL reports will remain private in HackerOne. He attributes the change to an avalanche of reports, many quickly assessed as low severity, and says a public process may distribute assessment work across the community, while acknowledging that it can give attackers a longer window to exploit a reported issue.
Source: Haxx