No one in the seven-person curl security team is on or runs Windows. People sending us Windows-only flaws makes us groan and roll eyes. And sometimes hyperventilate a little.
Why this is so? Because no one in the team wants to be on Windows, and no other curl contributor is active enough, Windows-knowledgeable and interested in joining the team. Let me know if you are someone like that who I've just not noticed.