# curl vulnerability disclosures

- **Series role:** reporting control and high-frequency pipeline sentinel
- **Metric:** public curl vulnerability disclosures per quarter
- **Coverage:** see `summary.json` and the central observation store
- **Data through:** the latest committed primary-source record
- **Upstream:** <https://curl.se/docs/vuln.json>
- **Current status:** monitoring; descriptive change only; causality unresolved

## What this series measures

curl publishes a machine-readable record of its disclosed vulnerabilities. This indicator counts one record in the quarter of its public `published` timestamp. Missing quarters remain in the data as explicit zeros.

The series measures **public disclosures** in one fixed software project. It does not measure every vulnerability that exists, the amount of security research performed, or scientific progress as a whole. Its main value is that the codebase and public record are stable enough to test the full indicator pipeline at high frequency.

## Snapshot facts

`summary.json` is the current source of truth for record counts, annual and quarterly totals, severity, attribution bands, and the latest partial period. `check.mjs` recomputes those facts from the committed raw snapshot and checks them against `data/series-observations.json` and `data/series.json`. The latest period is never silently annualized.

## AI attribution

The audit layer separates four mutually exclusive finder-credit bands:

1. `explicit_ai_marker` — the credit names an AI system, method, powered-by wording, or explicit collaboration marker;
2. `ai_affiliation_only` — the credit names a selected AI-security organization but does not state a method;
3. `fuzzing_marker` — the credit contains a fuzzing marker and no AI marker;
4. `other_or_unmarked` — none of the selected markers appear.

The compact central observation keeps one `numerator`: explicit AI markers plus AI-affiliation-only credits. Its `denominator` is the total number of disclosures in that quarter. This preserves the simple public panel while the per-record audit data retains the distinction.

These categories describe **credit text**. A finder may use AI without saying so. A researcher at an AI company may find a vulnerability without using a model. The marker is useful for sensitivity analysis, but it is not proof of the discovery method and cannot identify a causal AI effect on its own.

## Rebuild method

`fetch.py`:

1. downloads curl's public vulnerability JSON;
2. stores a canonical raw snapshot under `raw/curl-vuln.json`;
3. derives a per-record audit table with publication date, severity, finder credits, and attribution band;
4. aggregates records by quarter and fills missing quarters with zero observations;
5. rebuilds the compact central observation rows;
6. produces a quality summary with annual, quarterly, severity, and attribution counts;
7. can compare the committed snapshot with the current primary upstream without changing repository files.

Run:

```sh
python3 series/fixed-codebase-vulnerability-disclosures/fetch.py
python3 series/fixed-codebase-vulnerability-disclosures/fetch.py --from-snapshot
python3 series/fixed-codebase-vulnerability-disclosures/fetch.py --check-upstream
node series/fixed-codebase-vulnerability-disclosures/check.mjs
```

The source snapshot is committed. The smaller audit table and quality summary are deterministic build outputs and are published with the static site.

## Analysis status

`data/analysis-specs.json` contains a draft descriptive specification. It proposes a segmented quarterly count model, quarter effects, and an exposure adjustment for the incomplete final period.

January 2025 is only a descriptive marker because the first broad AI-marked finder credits appear during 2025. It is not treated as an exogenous intervention. Search effort, incentives, release batching, triage, and disclosure rules remain plausible alternative explanations.

## Limitations

- There is no denominator for researcher effort, submissions, model calls, inference compute, or search time.
- curl publishes vulnerabilities in release-related batches, so short-period movements partly reflect timing.
- Finder credits are incomplete and noisy evidence about the method used.
- More disclosures, especially low-severity findings, need not imply greater security value.
- The latest period may be incomplete and must be read from `summary.json` rather than inferred from the calendar.
- One software project is not representative of science.

## Methodological inspiration

The decision to use a fixed, rebuildable outcome series and to keep attribution separate from the measured count was inspired in part by METR's [“LLMs' Contribution to Discoveries”](https://metr.org/notes/2026-08-14-llm-contribution-to-discoveries/) and Thomas Cunningham's public [`ai-discovery-data`](https://github.com/tecunningham/ai-discovery-data) repository.

This tracker keeps its own schema, rebuild script, checks, analysis status, and public presentation. The source snapshot and all derived data are rebuilt from curl's primary upstream rather than copied from the reference repository.