Steam Windows Client Local Privilege Escalation 0day
I also had a look at Valve&#x27;s HackerOne policies recently and was unimpressed for a variety of reasons:<p>- The &quot;Exclusions&quot; are <i>very</i> poorly defined:<p><i>Valve will have the right to determine CVSS classification, report validity, duplications, exclusions and out-of-scope bugs in its sole discretion.</i><p>- What&#x27;s &quot;In Scope&quot; is <i>extremely</i> vague. Yes, it&#x27;s a list of domains, however Steam uses way more domains than that. Even then, not everything is tied to a &quot;domain&quot; as such, for instance Steam provides P2P networking. Executables are indeed mentioned, but again, it&#x27;s vague.<p>- Payouts seem low.<p>The HackerOne profile is something I would expect of (and would be acceptable for) a 10 person company, not a massive corporation with millions of users.