On January 31, 2026, curl ended its paid bounty program.
curl’s decision, the numbers behind it, and a partial recovery
The curl maintainer Daniel Stenberg cited a clear change in submission quality as the reason for closing the program. According to his account, confirmed vulnerabilities dropped from above 15% in previous years to below 5% starting in 2025. Across the program’s lifetime, curl’s bounty effort helped uncover 87 confirmed vulnerabilities and paid researchers more than $100,000.
Stenberg later reported an improvement: in April he said the share of confirmed vulnerabilities had returned to roughly 15%–16%. He also observed extensive AI use in submissions, noting that researchers were finding real problems even as the volume of submissions created extra work for maintainers.
Google’s pause and its defined scope
Google also announced a pause in parts of its vulnerability programs. The company made clear that the pause has a defined scope: supply chain submissions and outstanding reports remain unaffected. Separately, Google’s wider vulnerability rewards programs paid researchers $17.1 million in 2025, underscoring that the closures and restrictions have affected particular programs rather than an across-the-board retreat.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhy some bug bounty programs are pulling back
Bug bounty programs reward eligible security findings under defined rules, but every submission still requires developer review, reproduction, and impact assessment. The source explains the core tension: a convincing report about an imaginary vulnerability can consume time a small security team needs for genuine problems. The combination of higher submission volume and lower confirmed-vulnerability rates strained some programs’ ability to operate effectively.
How to make a report reproducible — the checklist
The practical remedy offered for hunters is straightforward: make every report possible to reproduce. Before submitting, check that your report includes:
- The affected asset or software version, with confirmation that your testing falls within the program's scope.
- The setup and exact steps needed to reproduce the issue, including any required account permissions.
- The expected behavior and the actual result, supported by relevant requests, responses or other evidence with sensitive information removed.
- The demonstrated security impact, with any assumptions or untested possibilities clearly identified.
A four-week practice plan and where TryHackMe fits in
For beginners the source recommends focused practice over a month, with measurable outputs:
- Week one: networking, operating system and web basics. Draw a simple request flow and explain where identity and permissions are checked.
- Week two: choose one vulnerability type and practise it across several authorized labs, keeping short records of the evidence behind each result.
- Week three: use AI for hints after making your own attempt. Revisit an earlier lab without help, then examine logs or other evidence a defender could use to spot the activity.
- Week four: write a complete report for a lab finding and have a peer reproduce it, or follow it yourself from a fresh setup and fix anything missing.
The source highlights TryHackMe as an example learning environment: browser-based labs and guided learning paths require no setup, and TryHackMe reports more than 8 million learners. Its Cyber Security 101 learning path covers networking, Linux and Windows fundamentals, web application basics, and offensive and defensive security.
What this means for bug hunters, maintainers, and employers
Bug hunters should treat AI as an amplifier rather than a shortcut: use models to explain errors, suggest questions, or review clarity, but attempt tasks first and ask for limited hints. Maintain the habit of recording what you changed, what happened, and why — then reproduce the task without notes.
Maintainers face a workload trade-off: they need clear, reproducible reports to triage effectively, especially when submission volume climbs. Employers and procurement leaders should note that bounty income depends on a finding being valid, eligible, and covered by program payment rules; readiness for a live program “depends on your skills and its rules,” so training and clear scope definitions matter.
The practical upshot is modest and precise. Programs such as curl’s and Google’s have shown how volume and the quality of evidence can change incentives and operations. For newcomers, the safer path is deliberate skill-building: practice in authorized labs, insist on reproducible evidence, use AI as a helper rather than a creator, and measure progress by what you can explain and reproduce. That combination is the clearest route from beginner to a contributor whose findings save time rather than consume it.
