Six Open-Source Bug Bounties Went Dark in 2026. It Wasn’t the Money.

curl. HackerOne's Internet Bug Bounty. Node.js. Nextcloud. Google's OSS VRP. A month-by-month timeline of the collapse, the one mechanism behind all of it, and the half of the market that's rising while this one falls.

I started pulling changelogs and issue threads after the third or fourth "we're pausing our bounty" announcement in a row, because the individual stories were everywhere and the pattern was nowhere. Once you put the dates next to each other, the pattern is one sentence long.

Discovery got industrialized. Remediation didn't.

Here's the timeline, assembled.

January through October, entry by entry

January 2026 — curl ends its bug bounty. Daniel Stenberg announced it on GitHub: "The change, the end of the bounty, is officially set for January 31." The project that spent years running one of the most respected open-source bounties in existence just… stopped. No scandal, no drama. The math stopped working.

March 27 — HackerOne pauses the Internet Bug Bounty. This was the loud one. IBB is the umbrella program that funds bounties for core open-source infrastructure — the software under everything…