{
  "slug": "bug-bounty-human-reporter",
  "title": "The bounty programme that closed because reading got more expensive than writing",
  "summary": "curl ended its bug bounty in January 2026 after a flood of AI generated reports. The same tools are also finding real bugs. The economics broke, not the research.",
  "lede": "In January 2026 the curl project ended its bug bounty after years of running one of the most respected disclosure programmes in open source. The reports had not stopped coming. That was the problem.",
  "date": "2026-09-23",
  "reading_time": "17 min read",
  "category": "Standards",
  "tags": [
    "bug bounty",
    "vulnerability disclosure",
    "AI slop",
    "curl",
    "triage",
    "security research",
    "PSIRT"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Bug%20Bounty%20Human%20Reporter/1200_630/blog.jpg",
  "url": "/blog/bug-bounty-human-reporter.html",
  "wordcount": 3975,
  "related": [
    "ai-pull-request-flood",
    "sigstore-human-layer",
    "human-feedback-integrity"
  ],
  "schema": "Article"
}