Thanking Security Researchers: A Hall of Fame Policy Without a Bounty

The curl project's security.txt, fetched on 18 October 2026, says it offers "NO (zero) rewards or other kinds of compensation" for reported problems, but offers "gratitude and acknowledgments clearly stated in documentation around confirmed issues." That is a complete reward policy in two lines, and researchers keep reporting to the project.

If you pay nothing, how you credit people is your policy.

What's affected

Any company or project without a bounty. Credit lives in three places, and each has its own rules:

• Your advisory. You control the wording and the format.
• A GitHub repository advisory. The Credits section lets you search by username, email or full name and assign a type such as Finder, Reporter or Remediation developer. Credited people can accept or decline, accepted usernames become public when you publish, and only the advisory's creator can add credit.
• A CVE record. The CVE Record Format has an optional credits element with types including finder, reporter, analyst, coordinator, remediation developer, remediation reviewer, remediation verifier, tool and sponsor. The CNA Rules (4.2.0, rule 5.2.4) say the description must not credit anyone, so use the credits element or your advisory.

What to do now

1. Write one paragraph in your policy: "We credit reporters in the advisory for each confirmed issue, using the name you give us, unless you ask us not to."
2. Ask in your first reply how the person wants to be named, or whether they want no credit at all.
3. Credit everyone who contributed, including people who confirmed a fix, not only the first finder. Use the role labels GitHub and CVE already define.
4. Keep a plain acknowledgments page, and link it from the Acknowledgments field in security.txt. A list with name, year and link to the advisory is enough.
5. Do not list reports that were closed as not applicable. Seth Larson has argued that platforms should remove public credit from abusive reporters, because credit counts reward volume.
6. Send a short thank-you the day the advisory is published, with a link.

Quick check

Sources

• curl security.txt
• GitHub Docs: Creating a repository security advisory
• CVE Record Format JSON schema
• CNA Operational Rules data, version 4.2.0
• Seth Larson: New era of slop security reports for open source