Do minor curl vulnerabilities in the open

>An obvious recent trend is that the moment we announce a new set of CVEs and their associated fixes, there is an army of AI-using researchers who throw all those at their models and harnesses to find similar mistakes or omissions in the fixes. By taking this process to the public all the way, ideally we get more help to do that scrutiny better before we ship releases.

>We recognize that the amount of work needed per received vulnerability report does not shrink by doing them in public, but we think that we might share the burden among more people easier, and we hope that lessons and documentation brought up in these discussions will be easier to spot and learn from.

This sounds like an actual Circle of Hell.

From my view, it just crystalizes that critical software should be supported at international levels. Looking at this page https://curl.se/sponsors.html and this page https://opencollective.com/curl shocks me that my smallish county has larger budgets and grants than this software receives in an entire year.