The OpenSSF scorecard scores #curl 8.9 out of 10. https://scorecard.dev/viewer/?uri=github.com/curl/curl

Yeah...

"For curl’s founder and lead developer, reliability includes the quiet maintenance that users may never notice. Daniel’s writing opens up the work of keeping this widely used piece of internet infrastructure healthy as it continues to change."

I'm listed among these amazing "people making the world more reliable": https://rootly.com/top50#systems

Welcome Sai Harsha as #curl commit author 1564: https://github.com/curl/curl/pull/23582

My #FOSDEM 2027 talk proposal. What do you think I should add/change ? (before I submit it)

https://gist.github.com/bagder/0a47acb9e8ffb7d14a2e05a41edf4b9b

Welcome to the new #curl vulnerability disclosure policy: https://curl.se/dev/vuln-disclosure.html

13 pending security advisories currently being worked on in the public: https://github.com/curl/curl-www/pulls

my week: https://lists.haxx.se/pipermail/daniel/2026-October/000172.html

security, public, AI aided changes, we can’t ignore

Guess which project that just had *24* sweet hours of not a single vuln report coming in? This is like holiday. Wohoo. ⛱️ 🍹 😎

Thanks team for the massively successful redirect actions this week. Hardly anyone looks at the curl code right now. 😎

The brotli problem is indeed in the C library:

CVE-2026-111497: out-of-bounds write permits remote code execution

on Monday I will create 13 new pull-requests with the pending Security Advisories for coming #curl CVEs with severity LOW or MEDIUM. Then our new policy takes effect and a lot less vulnerability work in curl will be done in private, and almost all of it will go public. You are all invited to help out.

gosh, a vulnerability report just arrived that was... *gasp* seemingly written by a human!

Coffee cup for the current Open Source workload and situation.