Trying to put myself in the shoes of the Valve employee: I don't think they were trying to save their company money, but it still wasn't a smart move. As a sec

Trying to put myself in the shoes of the Valve employee: I don't think they were trying to save their company money, but it still wasn't a smart move. As a security team employee, I think it's easy to react defensively to every vulnerability report, to take them as critiques of the quality of your work. So it's natural for the first reaction to be jumping to "this is not a real report" or "this is a dupe". But people in this position should think about the upside/downside of their actions. ACCEPT - Upside: You show that your security team is responsive, you build trust with an active security community member. Downside: Your company pays out some fee (so tiny in big picture) DENY - Upside: Your company doesn't pay out a fee. Downside: Usually a net negative for your company's reputation in security community, some chance you cause PR issues for your company.