Ars Technica’s Kyle Orland recently found a security issue with Valve’s online marketplace, Steam. “Out of respect for the privacy of Steam’s more than 50 million users”, Ars didn’t immediately publish the article. Instead, it contacted Valve.
Barely three hours after being notified, the exploit had been fixed. That’s fast. But what’s really interesting is that Valve kept its mouth shut the entire time, neither commenting on the site or even publicly admitting that the exploit had been discovered.
The full piece on Ars details how the exploit was discovered and how easy it was to do, while also raising the point that by keeping quiet on the matter Valve is potentially discouraging further acts of voluntary “white hat” security existence.