Some websites block curl requests based on the user agent, wouldn't it be better to use something like Mozilla/5.0 (compatible; https://keepassxc.org/) instead?

I didn't want to add KeePassXC to the User-Agent to protect users' privacy and adding a fake browser User-Agent seemed a little unnecessary, because we are only querying the favicon, which very often is just a static resource.

I didn't want to add KeePassXC to the User-Agent to protect users' privacy

That's a very good point.

I think keeping the user agent as just "curl" is a giveaway that it's KeePassXC -- indirectly, anyway. What version of curl uses the user agent string "curl" verbatim? None, the command-line curl will do this:

$ curl -v http://google.com 2>&1 | grep User-Agent
> User-Agent: curl/7.58.0

So maybe we should append the libcurl version to the string to match the CLI behavior?

Maybe something like this:

diff --git a/src/gui/EditWidgetIcons.cpp b/src/gui/EditWidgetIcons.cpp
index af4476ac..3a5a7bcf 100644
--- a/src/gui/EditWidgetIcons.cpp
+++ b/src/gui/EditWidgetIcons.cpp
@@ -197,7 +197,7 @@ QImage EditWidgetIcons::fetchFavicon(const QUrl& url)
         curl_easy_setopt(curl, CURLOPT_URL, baUrl.data());
         curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 5L);
         curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
-        curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl");
+        curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/" LIBCURL_VERSION);
         curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
         curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L);
         curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1L);

I was thinking about it, but I left it out on purpose, because IMHO stating the exact curl version is more information than a server needs.

I agree, but if we're talking about fingerprinting based on user agent strings, then the "curl" stands out more than "curl/someversionnumber"

I just want it to not say "hey, look, I'm a password manager downloading things". At least PyCURL seems to also have a user agent variant without version number. I don't think a "curl" string without version will draw very much attention.