---
title: "Not a Security Issue"
url: https://daily.dev/posts/not-a-security-issue-uf7fwvv04
source_url: https://nesbitt.io/2026/05/12/not-a-security-issue.html
type: article
source: "Andrew Nesbitt"
published: 2026-05-12T11:03:15.155Z
updated: 2026-05-12T11:03:42.099Z
tags: ["security", "open-source", "curl"]
reading_time: 7
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Not a Security Issue

**[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 7 min read · 0 upvotes · 0 comments

## Summary

An AI-assisted security scan of the curl codebase produced unusually low noise because the scanner read curl's VULN-DISCLOSURE-POLICY.md and automatically demoted findings that fell under the project's own exclusion categories — things like NULL dereferences triggered by a malicious server, small memory leaks, and command-line-dependent bugs. The post argues that well-written security policy files with specific exclusion lists and threat model reasoning can steer agentic scanners before findings ever reach a maintainer's inbox. It surveys prior art from Node.js, Django, and Chrome, and offers practical guidance: maintain a SECURITY.md with a contact address, build an exclusion list with named patterns and reasoning that generalises, and write a short threat model. A new category worth adding is 'documentation not matching behaviour', which AI scanners flag frequently but is only a security issue when the documented behaviour was a relied-upon security guarantee.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://nesbitt.io/2026/05/12/not-a-security-issue.html>

## Similar posts on daily.dev

- [Curl project, swamped with AI slop, finds not all AI is bad](https://daily.dev/posts/curl-project-swamped-with-ai-slop-finds-not-all-ai-is-bad-nl7yihgjv) · The Register · 0 upvotes · 0 comments
- [High-Quality Chaos](https://daily.dev/posts/high-quality-chaos-gkbh5roqh) · daniel.haxx.se · 3 upvotes · 0 comments
- [A new breed of analyzers](https://daily.dev/posts/a-new-breed-of-analyzers-c8hkmveo2) · daniel.haxx.se · 14 upvotes · 3 comments

---

Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#curl](https://daily.dev/tags/curl)

[View this post on daily.dev](https://daily.dev/posts/not-a-security-issue-uf7fwvv04)