The curl project stops their bug bounty:

"We have concluded the hard way that a bug bounty gives people too strong
incentives to find and make up "problems" in bad faith that cause overload and abuse."

https://github.com/curl/curl/pull/20312/files#diff-aec5a5d5f80adcb1c5be7398e98b271b007849d5cff357fb437f5faf242b3713