The policy link[0] page still has a link to the bug bounty program[1] which still discuss monetary compensation.

[0] https://curl.se/dev/vuln-disclosure.html

[1] https://curl.se/docs/bugbounty.html

Although it's not mentioned in those, it's going away at the end of the month: https://news.ycombinator.com/item?id=46701733 https://news.ycombinator.com/item?id=46678710