this makes me really upset

Curl project discontinued its HackerOne bug bounty program due to overwhelming AI-generated false vulnerability reports. Daniel Stenberg and maintainers faced a flood of low-quality submissions with fabricated security issues, including reports about non-existent buffer overflows and use-after-free bugs in unrelated code. The signal-to-noise ratio became unsustainable, with AI-generated reports wasting time that could be spent on legitimate security work. While AI security research tools like Expo show promise when used properly, indiscriminate automated submissions are forcing critical open-source projects to abandon bug bounty programs entirely.