I spent over three hours yesterday debugging the latest #curl hackerone report. I think I understand it now.

Next tricky step is now to assess the security impact. Is there one?