Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Valve bug bounty programs

valvesoftware.com Updated

Valve runs one public program: a HackerOne bug bounty paying up to $7,500.

Top reward
$7,500
HackerOne
Programs
1
1 pays cash
Targets in scope
20
5 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Valve runs.

  • Valve

    HackerOne · Bug bounty

    Open

    Top reward

    $7,500
    Critical
    $7,500
    High
    $2,500
    Medium
    $750
    Low
    $200
    Safe harbor
    Partial
    First response
    1 hour average

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

20 targets. 7 excluded.

  • *.steamstatic.com

    Wildcards Critical

  • api.steampowered.com

    Web Critical

  • developer.valvesoftware.com

    Web Low

  • help.steampowered.com

    Web Critical

  • partner.steamgames.com

    Web Critical

  • partner.steampowered.com

    Web Critical

  • playartifact.com

    Web Critical

  • steamcommunity.com

    Web Critical

  • store.steampowered.com

    Web Critical

  • storefront.steampowered.com

    Web Critical No bounty

  • support.steampowered.com

    Web Critical

  • wiki.teamfortress.com

    Web Critical No bounty

  • www.counter-strike.net

    Web Critical

  • www.dota2.com

    Web Critical

  • www.teamfortress.com

    Web Critical

  • www.valvesoftware.com

    Web Critical

  • com.valvesoftware.Steam

    Android Critical

  • https://github.com/valvesoftware

    Source code Critical No bounty

  • Steam Client

    Products and areas Critical

  • Steam Servers

    Products and areas Critical

No target matches. Try part of a host name, such as the company name.

Out of scope 7

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • store.valvesoftware.com

  • valvestore.forfansbyfans.com

  • list.valvesoftware.com

  • translation.steampowered.com

  • valvestore.forfansbyfans.com,store.valvesoftware.com

  • www.steamgames.com

  • www.steampowered.com

Recent changes

Reward and scope changes across every Valve program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Valve products, from the NVD.

Search NVD
  • CVE-2023-38312 High

    A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the underlying server via the motdfile console variable.

  • CVE-2023-35855 Critical

    A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile console variable.

  • CVE-2023-30382 High

    A buffer overflow in the component hl.exe of Valve Half-Life up to 5433873 allows attackers to execute arbitrary code and escalate privileges by supplying crafted parameters.

  • CVE-2021-30481 High

    Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.

  • CVE-2020-6017 Critical

    Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP_ReceiveUnreliableSegment() when configured to support plain-text messages, leading to a Heap-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution.

  • CVE-2020-6018 Critical

    Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES_GCM_DecryptContext::Decrypt() when compiled using libsodium, leading to a Stack-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution.

  • CVE-2020-6016 Critical

    Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment(), leading to a Heap-Based Buffer Underflow and a free() of memory not from the heap, resulting in a memory corruption and probably even a remote code execution.

  • CVE-2020-6019 High

    Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::Received_Data(), leading to an exception thrown from libprotobuf and resulting in a crash.

About this page

This page gathers every public program listed under valvesoftware.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.