informa
/
News

Valve tweaks bug bounty program after 'mistakenly' turning away researchers

Valve has expanded the scope of its HackerOne bug bounty program after a researcher was turned away for submitting a valid vulnerability found in Valve’s game distribution platform Steam.

Valve has expanded the scope of its HackerOne bug bounty program after a researcher was turned away for submitting a valid vulnerability found in Valve’s game distribution platform Steam.

That change to the program comes as part of a larger story covered by Ars Technica in which two researchers had their bug bounty submissions rejected by the HackerOne campaign, and in one case being told they were no longer able to submit future bugs following the rejection.

Following one of these rejections, Valve issued a statement to Ars acknowledging that the researcher was “incorrectly turned away” and that the idea that his report was classified as out of scope “was a mistake.”

“Our HackerOne program rules were intended only to exclude reports of Steam being instructed to launch previously installed malware on a user’s machine as that local user. Instead, misinterpretation of the rules also led to the exclusion of a more serious attack that also performed local privilege escalation through Steam,” reads the statement.

The new update to Valve’s HackerOne program now states that those above issues do fall within the scope of the bounty program. Beyond that, Valve notes that it is reviewing the details of the situations with some researchers, likely those mentioned in Ars’ report, but will not comment on any specifics.

Latest Jobs

Sucker Punch Productions

Bellevue, Washington
08.27.21
Combat Designer

Xbox Graphics

Redmond, Washington
08.27.21
Senior Software Engineer: GPU Compilers

Insomniac Games

Burbank, California
08.27.21
Systems Designer

Deep Silver Volition

Champaign, Illinois
08.27.21
Senior Environment Artist
More Jobs   

CONNECT WITH US

Register for a
Subscribe to
Follow us

Game Developer Account

Game Developer Newsletter

@gamedevdotcom

Register for a

Game Developer Account

Gain full access to resources (events, white paper, webinars, reports, etc)
Single sign-on to all Informa products

Register
Subscribe to

Game Developer Newsletter

Get daily Game Developer top stories every morning straight into your inbox

Subscribe
Follow us

@gamedevdotcom

Follow us @gamedevdotcom to stay up-to-date with the latest news & insider information about events & more