The policy link[0] page still has a link to the bug bounty program[1] which still discuss monetary compensation.

[0] https://curl.se/dev/vuln-disclosure.html

[1] https://curl.se/docs/bugbounty.html