cURL Drowning in AI-Generated Vulnerability Reports

The cURL security team is overwhelmed by a flood of low-quality vulnerability reports, many generated by AI. These reports waste significant time and resources (3-4 people, 30 minutes to 3 hours per report), drastically reducing the efficiency of finding genuine vulnerabilities. In 2025, approximately 20% of submissions are AI-generated junk, leading to a sharp decline in the valid report rate. The team is considering removing monetary rewards or implementing other measures to curb low-quality submissions to maintain team sanity and project security.