See for example Daniel Stenberg on the topic as it relates to cURL: https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/ and https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/
I'm curious how much of a problem this is to other open source projects
Committers, how much of this pain are you seeing, and are you using any AI tools to mitigate or address this issue?