@bagder thanks - I corrected my post. I was thinking vulnerabilities and not bugs.

@bagder your article made it abundantly clear that curl has already been extensively audited for years using all of the tools and techniques available. It is nice that a tool can find a single new vulnerability, around 20 bugs, with a small number of false positives.

Edited to correct vulnerability/bugs.