Reddit users discover that Valve pays rewards for reporting bugs

by

A Reddit post in the Steam community has been gaining traction, expressing appreciation towards Valve for providing a substantial reward to a user who exposed a bug. The post is named “In 2015: A user discovered they had received $4,000 worth of free games on Steam after accidentally exploiting a refund system bug“. This story revolves around a Steam user who found a glitch that enabled them to keep their games even after requesting a refund. When this user reported the issue, Valve recognized their honesty and permitted them to retain the games. However, it appears there’s more to the tale than meets the eye…

Steam will reward players for reporting bugs, with scaling rewards based on severity

The leading comment on this post provides a valuable resource, offering crucial insights about the story. This link takes you to Valve’s page associated with HackerOne, a firm specializing in cybersecurity through employing “ethical hackers” to continually evaluate a company’s security. By addressing potential issues that could be exploited by malicious attacks, they help companies improve their security measures. Although it may appear that Valve is merely acknowledging an honest user, this practice is quite common. On the HackerOne site, you can see that the compensation for identifying flaws in Valve’s platforms falls into four categories: Low, Medium, High, and Critical. For instance, reporting a low-severity bug could earn up to $200, while a critical bug report might win the hacker between $2,500 and $7,500. Since Valve partnered with HackerOne in 2018, they have distributed over two million dollars as rewards for discovered bugs.

As an enthusiast considering venturing into ethical hacking with Valve, it’s crucial to understand that not every submission will lead to a reward. Valve assesses the authenticity of each bug found and decides on the worth of successful submissions. For instance, just 13.96% of critical bug submissions seem to have been accepted, with the average bounty being roughly $750 – significantly lower than suggested ranges.

While it’s enticing to imagine that Valve might be a generous company appreciating its honest customers, it’s primarily focusing on protecting itself. A reported bug is essentially an issue they can rectify and stop others from misusing. Allowing a user to keep vast amounts of free games is negligible compared to the potential damage if this individual shared the information with other users, encouraging them to try the bug as well.

Reddit users expressed their thoughts on a post, with some appreciating the role of ethical hackers and others praising Valve. A comment with just “Common Valve W” indicated approval, while another said this action was an affordable PR boost for Valve. Many users were perplexed as to why Valve would penalize this user given they reported the bug and didn’t cause the problem intentionally. The original poster, along with other users, anticipated that Valve might retract all affected games, leaving the user empty-handed for their report.

A discussion ensued regarding the suspected Steam account holder, highlighting some intriguing facts: They possess an astounding collection of 37,000 games and 20,000 DLCs, yet devote an impressive 76% of their gaming hours to Dota 2. This individual appears to be a dedicated enthusiast of Valve’s offerings.

Read More

2025-03-03 23:02