Skip to content
Connect AISign inSign up free

Bug bounty program

VA

Valve

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
21
Disclosed reports
82
Subdomains
790

Most upvoted reports82

All reports
Most upvoted reports of Valve
ReportWeaknessDisclosedBountyVotes
RCE on Steam Client via buffer overflow in Server InfoAnalysed#470520Memory Corruption2019-03-15–1,289
Getting all the CD keys of any gameAnalysed#391217Access Control2018-10-31$20,000638
XSS in steam react chat clientAnalysed#409850Cross-site Scripting2019-01-07$7,500499
Modify in-flight data to payment provider Smart2PayAnalysed#1295844Input Validation and Logic2021-08-10$7,500443
Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageAnalysed#631956Command and Code Injection2019-10-08–420
SQL Injection in report_xml.php through countryFilter[] parameterAnalysed#383127SQL Injection2018-07-27$25,000410
Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injectionAnalysed#397545Memory Corruption2020-02-27–321
Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exeAnalysed#542180Memory Corruption2020-03-25$10,000268
Unchecked weapon id in WeaponList message parser on client leads to RCEAnalysed#513154Memory Corruption2019-09-17$3,000229
OOB reads in network message handlers leads to RCEAnalysed#807772Memory Corruption2021-05-04$7,500219

Subdomains790

Root
Scope
Name suggests:Staging
First seen
Text fileClear filters38 names
Subdomains of Valve
NameScopeFirst seen
beta.counter-strike.netstagingNot in the scope2026-11-14
preview.counter-strike.netstagingNot in the scope2026-11-14
beta.dota2.comstagingNot in the scope2026-11-14
preview.dota2.comstagingNot in the scope2026-11-14
staging.dota2.comstagingNot in the scope2026-11-14
en.staging.dota2.comstagingNot in the scope2026-11-14
www.staging.dota2.comstagingNot in the scope2026-11-14
staging.blog.dota2.comstagingNot in the scope2026-11-14
en.staging.blog.dota2.comstagingNot in the scope2026-11-14
partner.staging.dota2.comstagingNot in the scope2026-11-14
beta.playartifact.comstagingNot in the scope2026-11-14
preview.playartifact.comstagingNot in the scope2026-11-14
beta.steamcommunity.comstagingNot in the scope2026-11-14
preview.steamcommunity.comstagingNot in the scope2026-11-14
staging.steamcommunity.comstagingNot in the scope2026-11-14
china.beta.steamcommunity.comstagingNot in the scope2026-11-14
beta.steamgames.comstagingNot in the scope2026-11-14
preview.steamgames.comstagingNot in the scope2026-11-14
partner.staging.steamgames.comstagingNot in the scope2026-11-14
beta.steampowered.comstagingNot in the scope2026-11-14
preview.steampowered.comstagingNot in the scope2026-11-14
staging.steampowered.comstagingNot in the scope2026-11-14
api-beta.steampowered.comapi, stagingNot in the scope2026-11-14
cdn.beta.steampowered.comstagingNot in the scope2026-11-14
api.staging.steampowered.comapi, stagingNot in the scope2026-11-14
kgs.staging.steampowered.comstagingNot in the scope2026-11-14
www.staging.steampowered.comstagingNot in the scope2026-11-14
store.staging.steampowered.comstagingNot in the scope2026-11-14
partner.staging.steampowered.comstagingNot in the scope2026-11-14
support.staging.steampowered.comstagingNot in the scope2026-11-14
partnerupload0.staging.steampowered.comstagingNot in the scope2026-11-14
partnerupload1.staging.steampowered.comstagingNot in the scope2026-11-14
beta.teamfortress.comstagingNot in the scope2026-11-14
preview.teamfortress.comstagingNot in the scope2026-11-14
wiki-beta.teamfortress.comstaging, toolsNot in the scope2026-11-14
beta.valvesoftware.comstagingNot in the scope2026-11-14
preview.valvesoftware.comstagingNot in the scope2026-11-14
developer-beta.valvesoftware.comstagingNot in the scope2026-11-14

13 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated