I found a persistent XSS vulnerability on steamcommunity.com once upon a time. It used to be if you were playing a mod, the name of the mod could be shown in activity graphs and screenshot views. This was not sanitized whatsoever.

After 4 weeks of no response from their official email contact, I posted it on the (then entirely detached vBulletin based) Steam forums, with a notice I had disclosed the issue to all known to me @valvesoftware.com email addresses (including security@, which didn't bounce)

I had my account disabled, and spent 3 weeks emailing them asking what the fuck that was all about. It got re-enabled silently.