Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Unfiltered input allows for XSS in "Playtime Item Grants" fieldsAnalysed#353334 | Valid | Cross-site Scripting | Medium | 2018-05-24 | – | 13 |
| XSS @ store.steampowered.com via agecheck path nameAnalysed#406704 | Valid | Cross-site Scripting | Medium | 2019-01-07 | $750 | 14 |
| Reflected XSS on help.steampowered.comAnalysed#390429 | Valid | Cross-site Scripting | Medium | 2019-01-07 | – | 16 |
| Reflected XSS in www.dota2.comAnalysed#292457 | Valid | Cross-site Scripting | Medium | 2018-05-09 | – | 32 |
| Xss was found by exploiting the URL markdown on http://store.steampowered.comAnalysed#313250 | Valid | Cross-site Scripting | Medium | 2018-05-09 | $1,000 | 32 |
| Stored XSS in the guide's GameplayVersion (www.dota2.com)Analysed#380045 | Valid | Cross-site Scripting | Medium | 2019-01-07 | $750 | 36 |
| Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile NameAnalysed#351171 | Valid | Cross-site Scripting | Medium | 2018-05-24 | $750 | 42 |
| XSS in steam react chat clientAnalysed#409850 | Valid | Cross-site Scripting | Critical | 2019-01-07 | $7,500 | 499 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.