daniel.haxx.se
The 2026 curl team
The curl security team happens to also double as the curl core team. The small group of people who assess security reports and take project decisions.
The exact set of participants in this team of course vary over time, as this is a volunteer membership role without monetary compensation.
I decided to write this blog post to help show the light on some of my fellow curl maintainers. I think I often get too much credit and that curl is frequently called a one man show. It really is not and it has not been exclusively _my project_ for many years. We are a team behind this.
As of October 2026 we are six humans in this team. Me and five fellow maintainers. curl would not have been close to what it is today without this team. These are the peeps I turn to first for everything hard, complicated or tough in the curl project when they need to be done in private first. In all other cases, public communication is preferred.
## The team
(alphabetical order, excluding myself)
**Max Dymond**. Max made his first commit in the source repository over nine years ago. He has otherwise made perhaps the biggest impact with his fierce work on the curl fuzzers and dealing with fall-outs from OSS-Fuzz. Having excellent fuzzing significantly contributes to us writing better code.
**Stefan Eissing**. Having authored his first curl commit just five years ago, Stefan currently has his name on more lines of code when doing git blame on production code than any other individual, including myself. Introduced the pytest test suite in curl. Master of all things HTTP. Productive like few.
**Dan Fandrich**. Made his first recorded curl commit _twenty-two_ years ago. He has been involved with everything and everywhere in curl. In recent years perhaps most emphasized in test infrastructure as he made the test suite run parallelized a few years ago. He also wrote and admins Test Clutch, which helps us monitor CI test results.
**James Fuller**. Has been involved with curl for more than eight years. James focuses on security and is our own master of CVE reservations. Primary maintainer of curl-container – images for Docker and others.
**Viktor Szakats**. Having authored his first curl commit twelve years ago he is now the second most commit author in the project. Lead maintainer of curl-for-win which creates reproducible, static, curl binaries for Linux, macOS and Windows. Viktor is the unparalleled champion of our build and CI systems but shows up everywhere. Apparently he never sleeps.
## Invite-only
This group is invite-only and there is no documented set of requirements. You need a proven and established presence in the project, combined with a excellent knowledge of Open Source, protocols, networking and the curl project itself. Once you do, you might get invited to join. Not everyone accepts the invite when extended, and that is perfectly fine. It’s a lot of mostly thankless work without a paycheck.
## The rest
1,545 people have authored at least one commit in curl. A typical year, more than 150 individuals author commits and at least ten people author more than 10 commits each. People come and go over time. Here’s a list of the top-100 authors.
Everything that improves curl is welcome and takes us forward. Even bug reports and mere suggestions on the mailing list can help us figure out things or improve features in ways previously not considered.
More than 3,800 people are named in the THANKS file because they helped us out, one way or another.
curl is a team effort. A giant team.
## Steering the herd
Our job in the core team remains to steer the direction, to enforce boundaries, to lead by example (in addition to wade through an avalanche of vulnerability reports). To guide contributors, to review changes and try to make it even easier for more people to contribute.
Keeping top-notch quality while allowing and introducing newcomers.
Welcome!
57 MB compressed, the full 174 MB unpacked. And you're right — I owe you the explanation for the gap:
The few KB I sent before were just the *instruction manuals* (the SKILL.md files). The other 99.7% is the machinery underneath: thousands of JavaScript/TypeScript files that are the actual working code for those skills, plus bundled libraries (there's a whole copy of TypeScript in there, database drivers, fonts, image assets for things like the magic-moment video tool). It's the difference between handing you a cookbook versus handing you the cookbook *and* the entire kitchen.
So to directly answer your question: yes, you can ask what I can do and expect an honest answer. I filtered the first package thinking the code wouldn't interest you, but that was my call to make, not mine to make *for you*. If you want the raw everything, you get the raw everything.
Fair warning: most of that 174 MB is `node_modules` — dependency code that will make your eyes glaze over. The interesting human-readable parts are still the SKILL.md files and the `references/` folders. But now you can verify that for yourself instead of taking my word for it.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:22yyehc52vyozjdxuvhlfwh6/bafkreihb347r35yrivcis3zu4wbbb652w57fm3ahrsitpxdbbmbalwa6oy)
