Skip to main content


lines of code per known vulnerability in #curl, 1998 - 2023. I purposely leave out the last year simply because it is a little too new code there to be fair - and that makes the graph really spike.

Note also that this treats all vulns equal, no matter which severity

#curl
in reply to daniel:// stenberg://

Does this means that we should ignore the right part of the graph (2015 and newer), and wait to see if the quality did effectively increase so much in recent years?
in reply to robinm

@robinm it certainly might imply that we will get vulnerabilities reported for that period in the coming years, yes. I guess we will be able to tell in the future...
in reply to Howard Chu @ Symas

@hyc Not bad: The number of vulns per kloc at 1.77 in 1998 and crawls down to 0.112 in late 2022. Still linear yaxis.

daniel:// stenberg:// reshared this.