My thoughts on the recent curl bug report debacle on HackerOne