BUG-BOUNTY.md (3589B)
1 <!-- 2 Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. 3 4 SPDX-License-Identifier: curl 5 --> 6 7 # The curl bug bounty 8 9 The curl project runs a bug bounty program in association with 10 [HackerOne](https://www.hackerone.com) and the [Internet Bug 11 Bounty](https://internetbugbounty.org). 12 13 ## How does it work? 14 15 Start out by posting your suspected security vulnerability directly to [curl's 16 HackerOne program](https://hackerone.com/curl). 17 18 After you have reported a security issue, it has been deemed credible, and a 19 patch and advisory has been made public, you may be eligible for a bounty from 20 this program. See the [Security Process](https://curl.se/dev/secprocess.html) 21 document for how we work with security issues. 22 23 ## What are the reward amounts? 24 25 The curl project offers monetary compensation for reported and published 26 security vulnerabilities. The amount of money that is rewarded depends on how 27 serious the flaw is determined to be. 28 29 Since 2021, the Bug Bounty is managed in association with the Internet Bug 30 Bounty and they set the reward amounts. If it would turn out that they set 31 amounts that are way lower than we can accept, the curl project intends to 32 "top up" rewards. 33 34 In 2025, typical "Medium" rated vulnerabilities are rewarded 2,500 USD each. 35 36 ## Who is eligible for a reward? 37 38 Everyone and anyone who reports a security problem in a released curl version 39 that has not already been reported can ask for a bounty. 40 41 Dedicated - paid for - security audits that are performed in collaboration 42 with curl developers are not eligible for bounties. 43 44 Vulnerabilities in features that are off by default and documented as 45 experimental are not eligible for a reward. 46 47 The vulnerability has to be fixed and publicly announced (by the curl project) 48 before a bug bounty is considered. 49 50 Once the vulnerability has been published by curl, the researcher can request 51 their bounty from the [Internet Bug Bounty](https://hackerone.com/ibb). 52 53 Bounties need to be requested within twelve months from the publication of the 54 vulnerability. 55 56 The curl security team reserves themselves the right to deny or allow bug 57 bounty payouts on its own discretion. There is no appeals process. 58 59 ## Product vulnerabilities only 60 61 This bug bounty only concerns the curl and libcurl products and thus their 62 respective source codes - when running on existing hardware. It does not 63 include curl documentation, curl websites, or other curl related 64 infrastructure. 65 66 The curl security team is the sole arbiter if a reported flaw is subject to a 67 bounty or not. 68 69 ## Third parties 70 71 The curl bug bounty does not cover flaws in third party dependencies 72 (libraries) used by curl or libcurl. If the bug triggers because of curl 73 behaving wrongly or abusing a third party dependency, the problem is rather in 74 curl and not in the dependency and then the bounty might cover the problem. 75 76 ## How are vulnerabilities graded? 77 78 The grading of each reported vulnerability that makes a reward claim is 79 performed by the curl security team. The grading is based on the CVSS (Common 80 Vulnerability Scoring System) 3.0. 81 82 ## How are reward amounts determined? 83 84 The curl security team gives the vulnerability a score or severity level, as 85 mentioned above. The actual monetary reward amount is decided and paid by the 86 Internet Bug Bounty.. 87 88 ## Regarding taxes, etc. on the bounties 89 90 In the event that the individual receiving a bug bounty needs to pay taxes on 91 the reward money, the responsibility lies with the receiver. The curl project 92 or its security team never actually receive any of this money, hold the money, 93 or pay out the money.