“Every security report has to have a human spend time to look at it and assess what it means.”
curl’s bug bounty has paid out over $70,000 and received 415 reports. Only 64 were real security problems. Now bounty hunters paste chatbot output that invents buffer overflows in code that has none. The hunter spends ten seconds generating it and a maintainer burns hours debunking it.