4 ms·

Valve is notorious for ignoring any vulnerability reports

• maerF0x0 7y ago
  any other sources?
  • jtylr 7y ago
    Only anecdotal, I once tried to report a persistent XSS issue on the game "hub" pages. After weeks of going back and forth with support (this was before the likes of hackerone) the ticket was closed and the issue was ignored.
    • iancarroll 7y ago
      On the other hand, before they started moving to HackerOne, they fixed several issues I reported either the next day or within a week or so. Their security@ was incredibly responsive. Now it seems it takes forever (I have reports waiting to be paid from them too, even ones they have already fixed.)
      • XMPPwocky 7y ago
        Yup. Have dozens of issues reported to security@, and responsiveness was great- usually human response same day, often in hours. H1 is veeeery slow by comparison, but, hey, I've made five figures off it so...
  • 7777fps 7y ago
    There was this one last year: https://arstechnica.com/information-technology/2019/08/valve-says-turning-away-researcher-reporting-steam-vulnerability-was-a-mistake/ https://arstechnica.com/information-technology/2019/08/valve...
  • hexpwn 7y ago
    https://hexpwn.github.io/2020/two-plus-year-old-steam-vulnerability/ https://hexpwn.github.io/2020/two-plus-year-old-steam-vulner...