Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Valve

Bug bounty on HackerOne valvesoftware.com

Accepting reports
Go to program Website
Top reward
$7,500
Top severity paid
Critical
Assets in scope
21
Public CVEs
29
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $7,500
for critical bugs.
Report on HackerOne
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $7,500 from $2,500
High $2,500 from $750
Medium $750 from $200
Low $200 from $100
Safe harbor
Partial We will generally permit external discussions of them (such as blog posts), with our permission.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

21 assets you may test, 7 excluded.

Web 15

  • api.steampowered.com Critical
  • developer.valvesoftware.com Low
  • help.steampowered.com Critical
  • partner.steamgames.com Critical
  • partner.steampowered.com Critical
  • playartifact.com Critical
  • steamcommunity.com Critical
  • storefront.steampowered.com Critical No bounty
  • store.steampowered.com Critical
  • support.steampowered.com Critical
  • wiki.teamfortress.com Critical No bounty
  • www.counter-strike.net Critical
  • www.dota2.com Critical
  • www.teamfortress.com Critical
  • www.valvesoftware.com Critical

Android apps 1

  • com.valvesoftware.Steam Critical

iOS apps 1

  • com.valvesoftware.Steam Critical

Source code 1

  • https://github.com/valvesoftware Critical No bounty

Wildcard domains 1

  • *.steamstatic.com Critical

Products and areas 2

  • Steam Client Critical
  • Steam Servers Critical
Out of scope (7)
  • store.valvesoftware.com
  • valvestore.forfansbyfans.com
  • list.valvesoftware.com
  • translation.steampowered.com
  • valvestore.forfansbyfans.com,store.valvesoftware.com
  • www.steamgames.com
  • www.steampowered.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Valve (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
  • Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third party.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Only interact with accounts you own or with explicit permission of the account holder.

Not accepted

  • Vulnerabilities reported by use of automated tools/scanners, without accompanying validation / POC
  • User enumeration without any further impact
  • Clickjacking without a well-defined security/privacy risk
  • Disclosure of software version numbers
  • Attacks that require social engineering/phishing
  • Attacks that require physical access to the user’s device
  • Open redirects or linkfilter bypasses that cannot be leveraged to programmatically exfiltrate sensitive information
  • Content Spoofing / Text Injection that cannot be leveraged for XSS or sensitive data disclosure
  • Host header injection without a specific proof of concept
  • Self XSS, or XSS that only affects out-of-date browsers
  • Denial of Service Attacks
  • Broken links to third party sites
  • Game bugs, glitches and gameplay exploits
  • Reports against Source Engine tools, e.g. Hammer, Source Filmmaker
  • Reports that require the user to open crafted game content: demo files, BSPs, etc not delivered as part of the exploit

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 17 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2023-38312 High 7.5 15 Oct 2023
CVE-2023-35855 Critical 9.8 19 Jun 2023
CVE-2023-30382 High 7.3 23 May 2023
CVE-2021-30481 High 8.0 10 Apr 2021
CVE-2020-6017 Critical 9.8 3 Dec 2020
CVE-2020-6018 Critical 9.8 2 Dec 2020
CVE-2020-6016 Critical 9.8 18 Nov 2020
CVE-2020-6019 High 7.5 13 Nov 2020
CVE-2020-15530 High 7.8 5 Jul 2020
CVE-2020-12242 High 7.8 27 Apr 2020
CVE-2020-9005 High 7.8 17 Feb 2020
CVE-2020-7951 High 7.8 27 Jan 2020
CVE-2020-7952 High 7.8 27 Jan 2020
CVE-2020-7949 High 7.8 27 Jan 2020
CVE-2020-7950 High 7.8 27 Jan 2020
CVE-2019-17180 High 7.8 4 Oct 2019
CVE-2019-15943 High 8.8 19 Sep 2019
CVE-2019-15944 Medium 5.3 5 Sep 2019
CVE-2019-15315 High 7.8 21 Aug 2019
CVE-2019-15316 High 7.0 21 Aug 2019
CVE-2019-14743 Medium 6.6 7 Aug 2019
CVE-2018-12270 Medium 5.4 20 May 2019
CVE-2017-17877 Critical 9.8 27 Dec 2017
CVE-2017-17878 Critical 9.8 27 Dec 2017
CVE-2016-5237 Medium 4.8 23 Jan 2017
CVE-2015-7985 High 7.2 24 Nov 2015
CVE-2015-4016 Medium 5.0 20 May 2015
CVE-2013-7128 Low 2.1 17 Dec 2013
CVE-2008-7203 Medium 5.0 11 Sep 2009

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

If you are a Steam user and have a security issue to report regarding your personal Steam account, please visit our support site https://help.steampowered.com/. This includes password problems, login issues, suspected fraud, and account abuse issues.

Please read the scope, bounty, and severity information carefully before submission. Our intent is to guide researcher attention to the most important areas and to reward the most actionable reports.

Scope

This program covers the Steam platform and current games developed and published by Valve. Please review the reward tables and scope descriptions below.

The Steam components in scope are:

  • Steam Client, Steam Client Service, and the SteamCmd command-line utility for Windows, Mac and Linux
  • Steamworks SDK
  • Steam mobile apps on iOS and Android
  • Steam Servers
  • Websites as noted on the Scope section of the program. Subdomains of listed websites are not in scope unless mentioned.

For games developed and published by Valve, if the game is in scope as noted on the Scope section of the program, then we accept reports against the following components:

  • Game client and server binaries.
  • First-party, unmodified, game servers.
  • Game coordinators.

Game bugs, glitches and gameplay exploits are not in scope for the bug bounty program.

No authorization is given to test any other websites, servers, game titles, or mobile applications. No bounties will be given for any disclosures relating to any applications outside the scope of this program.

Exclusions

The following items are considered out-of-scope for all Valve offerings:

  • Hypothetical issues that do not have any practical impact. Examples include:
    • Vulnerabilities reported by use of automated tools/scanners, without accompanying validation / POC.
    • User enumeration without any further impact.
    • Clickjacking without a well-defined security/privacy risk.
    • Disclosure of software version numbers (we maintain forks of several tools, and apply security patches accordingly).
  • Attacks that require social engineering/phishing.
  • Attacks that require physical access to the user’s device.
  • Attacks that involve the user running malware that then places or modifies content on the target machine, which Steam could later run as the local user.
    • However, any case that allows malware or compromised software to perform privilege elevation through Steam, without providing administrative credentials or confirming a UAC dialog, is in scope.
    • Additionally, any unauthorized modification of the privileged Steam Client Service is also in scope.
  • Open redirects or linkfilter bypasses that cannot be leveraged to programmatically exfiltrate sensitive information (e.g., cookies, OAuth tokens, etc.).
  • Content Spoofing / Text Injection that cannot be leveraged for XSS or sensitive data disclosure.
  • Host header injection without a specific proof of concept.
  • Self XSS, or XSS that only affects out-of-date browsers.
  • Denial of Service Attacks.
  • Broken links to third party sites.

Additionally, the following items are out-of-scope for issues with Valve games and related components:

  • Attacks that only affect or are only triggered in single-player games that are not caused by a previous multiplayer session (e.g., game files or resources downloaded by a game server).
  • Reports against Source Engine tools, e.g. Hammer, Source Filmmaker.
  • Reports that require the user to open crafted game content: demo files, BSPs, etc not delivered as part of the exploit.

While researching, we'd like to ask you to refrain from:

  • Denial of service.
  • Spamming.
  • Social engineering (including phishing) of Valve staff or contractors.
  • Any physical attempts against Valve property or data centers.

Dependencies

Valve services make use of a number of open source and commercial packages. If you discover a vulnerability in a library or OS component, we strongly advise you to follow responsible disclosure procedures directly with the vendor. We will not pay bounties on undisclosed vulnerabilities in dependent components.

Patches to dependent libraries are generally rolled out by our internal change management systems. Reports will not be accepted if they refer to vulnerabilities that have been fixed upstream, and scheduled, but not yet applied to our software or production systems.

We welcome reports that identify Valve systems that have fallen out of date (indicating a problem with our update or change management procedures).

Special Note for Valve Websites

Many Valve websites use a cookie called 'sessionid.' This is used only as an anti CSRF token and is not used for user authentication. Please do not report attacks resulting in leaking the value of this cookie as account takeover vulnerabilities.

Assessing Severity and Rewards

Please carefully review our guidelines for remote-code-execution exploits in Valve games.

IDOR for unreleased applications

We take unintentional leaking of unreleased applications on Steam seriously. If you are reporting an insecure object reference that can leak private details about an unreleased game (name, artwork, pricing, etc.), please make sure your report includes the relevant details for appid 3717370.

If the vulnerability only exists for applications with specific configuration conditions, please carefully describe the configuration as well as the insecure reference. Severity of this type of leak will depend on the type and complexity of the required configuration as well as the scope of any potential exposure.

IDOR for profile data

Insecure object references for information that Steam marks Private are in scope. For non-personally-identifying player data, severity is generally capped at Low.

Remote Code Execution reports - Severity

Remote code execution attacks can be complex to triage and assess. We place a premium on reports that can clearly demonstrate impact to users, and which are faster to technically validate.

Your report must meet the following requirements to be accepted:

  • Actual RCE must be demonstrated. Your report should include clear steps that reliably launch another application - e.g. Calculator - on the target machine.
  • The payload must be delivered over the network - not loading resource files already on the target computer.

Valve Games: Highest priority

For vulnerabilities in Valve games, the following are our highest priority for assessment, reward, and resolution:

  • Exfiltration of sensitive data from a Game Coordinator.
  • Client-to-client: malicious payload transmitted from one game client to another when playing peer-to-peer or connected to an unmodified game server.
  • Client-to-client: malicious clients that can crash other connected game clients with or without demonstrated RCE behavior.
  • Communication from malicious clients that can crash a vanilla dedicated server (i.e. no mods; using only default game assets).

Valve Games: Reduced priority

Reports of the following types may have their severity, and therefore reward, reduced one or more levels from the initial CVSS score:

  • Community server-to-client - malicious content including maps and textures, delivered from a community server.
  • User interaction required - reports that require victim to execute unusual console commands.
  • Client vulnerabilities that cannot be demonstrated against Windows game clients.

Ineligible for Bounty

Reports of any of the following types may be accepted as in-scope, but will not be eligible for a reward:

  • Reports that require crafted content (maps, sounds, mods, etc.) delivered via the Steam Workshop.
  • Techniques not specifically mentioned above that cause a game-client crash without demonstrated RCE behavior.
  • Techniques that require information from the target machine in order to function - for example, returning an address offset in memory in order to craft the payload.
  • Techniques that require the game to be run in a non-standard way - for example, with a debugger attached or with unusual startup parameters.

Responsible Disclosure and Guidelines

When submitting potential vulnerabilities, we ask that you follow HackerOne's general guidelines for disclosure as well as the following additional guidelines. A submission that does not meet these requirements may not qualify for a bounty.

  • Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
  • Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third party.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Only interact with accounts you own or with explicit permission of the account holder.

Valve embraces transparency in our security. We will generally disclose the details of vulnerabilities found, upon request. We will generally permit external discussions of them (such as blog posts), with our permission. We reserve the right to make exceptions to this policy at our discretion.

Please note that we will not consent to disclose reports if they have been marked out-of-scope or inapplicable, or where Valve has not taken a specific corrective action / mitigation.

The Fine Print

You must comply with all applicable laws in connection with your participation in this program. You are also responsible for any applicable taxes associated with any reward you receive.

We may modify the terms of this program or terminate this program at any time. We won’t apply any changes we make to these program terms retroactively.

Valve will have the right to determine CVSS classification, report validity, duplications, exclusions and out-of-scope bugs in its sole discretion.

Reports received through other channels prior to being received through the bug bounty program are not eligible for bounty.