The curl project is pausing vulnerability reports during July 2026 — the HackerOne submission form closes July 1 and reopens August 3. The maintainers are taking a planned summer break from security work, a practical decision that gives their team time off while notifying researchers in advance where submissions should go. This is unusual but not unprecedented in open-source projects, though it does create a vulnerability disclosure gap during that month.