Yeah, I'm quite confused. See also https://news.ycombinator.com/item?id=44411185 ("AI slop security reports submitted to curl"), and especially https://news.ycombinator.com/item?id=43907376 ("Curl: We still have not seen a valid security report done with AI help")