Tom de Bruijn (@tomdebruijn.com)

preparing for the worst One of these mantras I keep repeating is how we in the curl project keep improving, keep polishing and keep tightening every bolt there is. No one can do everything right from day one, but given time and will we can over time get a lot of things lined up in neat and tidy lines. And yet new things creep up all the time that can be improved and taken yet a little further. ## An exercise Back in the spring of 2025 we had an exercise at our curl up meeting in Prague. Jim Fuller played up an imaginary life-like scenario for a bunch of curl maintainers. In this role played _major incident_ we got to consider how we would behave and what we would do in the curl project if something like Heartbleed or a serious breach occur. It was a little of an eye opener for several of us. We realized we should probably get some more details written down and planned for. ## Plan ahead We of course arrange for things and work on procedures and practices to the best of our abilities to make sure that there will never be any such _major incident_ in the curl project. However, as we are all human and we all do mistakes, it would be foolish to think that we are somehow immune against incidents of the highest possible severity level. Rationally, we should just accept the fact that even though the risk is ideally really slim, it exists. It _could_ happen. ## What if the big bad happens We have now documented some guidelines about what exactly constitutes a _major incident_ , how it is declared, some roles we need to shoulder while it is ongoing, with a focus on both internal and external communication, and how we declare that the incident has ended. It’s straight forward and quite simple. Feel free to criticize or improve those if you find omissions or mistakes. I imagine that if we ever get to actually use these documented steps because of such a project-shaking event, we will get reasons to improve it. Until then we just need to apply our imagination and make sure it seems reasonable. https://daniel.haxx.se/blog/2025/09/09/preparing-for-the-worst/