Valve rolls out bug bounty program

Valve rolls out bug bounty program

PC games giant Valve has joined a long and illustrious list of companies with a public bug bounty page.

The firm has rolled out this security program via Hackerone, which is focused on the Steam client, but also all of its websites, SteamOS, Valve games, Steamworks SDK and much more.

The minimum pay-out for users who have found bugs is $100, with Valve having paid out $108,100 in total and 39 individuals thanked at the time of writing. The programme debuted four days ago (on May 7th, 2018).

"Valve recognizes how important it is to help protect privacy and security," Valve wrote.

"We understand that secure products and services are critical in establishing and maintaining trust with our users. We strive to consistently deliver secure and enjoyable experiences in all of our products and services.

"Security includes everyone. Our Steam users, our developers, third party software developers and the security community. Working together we can all make Steam and the Internet safer.

"Security of our networks and services is important for us and for you. We take it seriously. If you are a Steam user and have a security issue to report regarding your personal Steam account, please visit our Support site. This includes password problems, login issues, suspected fraud and account abuse issues.

"We are running this HackerOne bounty program to reward researchers for identifying potential vulnerabilities. Please review the following guidelines detailing the rules of this bug bounty program. Only research following these guidelines will be eligible for a bounty."

This follows hobbyist Ruby Nealon telling Ars Technica in 2016 that Valve "give so little of a shit about people's security findings". The hacker had been probing the company's services for years but gave up due to Valve's apparent apathy. 

PCGamesInsider Contributing Editor

Alex Calvin is a freelance journalist who writes about the business of games. He started out at UK trade paper MCV in 2013 and left as deputy editor over three years later. In June 2017, he joined Steel Media as the editor for new site In October 2019 he left this full-time position at the company but still contributes to the site on a daily basis. He has also written for, VGC, Games London, The Observer/Guardian and Esquire UK.