I found XSS in Steam, reported via ticket and email, eventually posted on their forums and found my steam account disabled. It took them 3 weeks and repeated at

I found XSS in Steam, reported via ticket and email, eventually posted on their forums and found my steam account disabled. It took them 3 weeks and repeated attempts to contact them for them to silently reenable my account. The XSS was in the screenshot viewer. Names of Source Mods were not escaped. Their fix was to never show Source Mod names on Steam Community at all.