why didn't they ask you about some (fixed) difficult to find issues that tools didn't find in the past, and introduce those again in the code?

@peturdainn I think the general idea from the organizers was that they should revert some old CVEs to inject likely flaws that way, but for some reason they did not seem to have done that for curl...