On Fri, 28 Sep 2018, Daniel Stenberg via curl-library wrote:
I think it might help us to attract more security researchers if we spell
out exactly how much money we intend to pay as rewards for potential finds -
especially now when have gotten pledges for a notable sum to use for this.
Here's a proposal from me.
I created a pull-request[1] with this proposal converted to documentation.
I'll appreciate your input!
You can view that markdown file[2] straight from the PR if you want.
[1] = https://github.com/curl/curl/pull/3067
[2] =
https://github.com/curl/curl/blob/c8b4df544058fdbfcbe709e85b75b4ddcdba7cad/docs/BUG-BOUNTY.md
--
/ daniel.haxx.se
-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette: https://curl.haxx.se/mail/etiquette.html
