Valve awarded the researcher that found the issue a bug bounty of $20,000.

from BBC News – Technology https://www.bbc.co.uk/news/technology-46183000