curl does offer a bug bounty. Unfortunately there's a more fundamental issue: being someone who has filed CVEs can provide some credibility for your resume, th

curl does offer a bug bounty. Unfortunately there's a more fundamental issue: being someone who has filed CVEs can provide some credibility for your resume, that's the financial incentive here, and also the root cause of many many issues with the CVE system.