curl bug bounty program