diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2020-12-14 10:08:05 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2020-12-15 08:57:07 +0100 |
| commit | c4d88f89a9c2da6104eae05948c968c1d63de978 (patch) | |
| tree | 4650e54c08eadb39f8902253af29cafefd5d2379 | |
| parent | bc7ecc71c0c11d22fdbe6415a7945bfc43dc3c33 (diff) | |
| download | curl-c4d88f89a9c2da6104eae05948c968c1d63de978.tar.gz | |
BUG-BOUNTY: minor language update
... and remove the wording about entries from before 2019 as the "within
12 months" is still there and covers that.
Closes #6318
| -rw-r--r-- | docs/BUG-BOUNTY.md | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/docs/BUG-BOUNTY.md b/docs/BUG-BOUNTY.md index 8ee9ac62f..c360f2915 100644 --- a/docs/BUG-BOUNTY.md +++ b/docs/BUG-BOUNTY.md @@ -22,7 +22,7 @@ details. # What are the reward amounts? -The curl projects offer monetary compensation for reported and published +The curl project offers monetary compensation for reported and published security vulnerabilities. The amount of money that is rewarded depends on how serious the flaw is determined to be. @@ -46,18 +46,14 @@ before a bug bounty will be considered. Bounties need to be requested within twelve months from the publication of the vulnerability. -The vulnerabilities must not have been made public before February 1st, 2019. -We do not retroactively pay for old, already known, or published security -problems. - # Product vulnerabilities only This bug bounty only concerns the curl and libcurl products and thus their respective source codes - when running on existing hardware. It does not include documentation, websites, or other infrastructure. -The curl security team will be the sole arbiter if a reported flaw can be -subject to a bounty or not. +The curl security team is the sole arbiter if a reported flaw is subject to a +bounty or not. # How are vulnerabilities graded? |