The curl project has updated its vulnerability disclosure process, requiring all low and medium severity vulnerability reports to be submitted as GitHub issues, effective October 26, 2026. Only high or critical vulnerabilities will be handled through direct communication.