“hsts.c, which provides functions for parsing and handling the Strict-Transport-Security response header, had only 4.46% line coverage, 18.75% function coverage, and 2.56% region coverage after over five years on OSS-Fuzz”
Five years of OSS-Fuzz on curl, and the HSTS parser was barely touched. The fuzzer never turned HSTS on and had no seed files with the header. Three small commits doubled coverage of hsts.c. Fuzzing badge on the README, security code untested underneath.