Bounties are only a decent income if you're: * In that *very* small slice of hackerdom who can manage consistently a $10k bounty a month * Working a pr

Bounties are only a decent income if you're: * In that *very* small slice of hackerdom who can manage consistently a $10k bounty a month * Working a pretty favorable currency and CoL conversion It takes a lot of discipline and well-developed process to handle vulnerabilities well. Many companies don't manage this. Instead, they are often earnestly bad at it. It's possible Valve is trying to get out of paying the bounty. It's also possible and even likely that they're honestly just bad at handling reports as an organization. That would make sense. At this point in time the primary reason to have a bug bounty program is so that you can can say you have one. Most will maybe get a handful of reports a quarter about low-hanging fruit.