{ "schema": "phishdestroy.text-export.v1", "object_type": "Published page text and corresponding PDF digest", "id": "security_timeline.html", "language": "en", "title": "Security Timeline — The Steam Dossier", "source_url": "https://phishdestroy.io/steam_dossier/security_timeline", "source_html_sha256": "d8bc0be9cb9915f3442ca05b6fa5c0c82e3ef11e791e4482f2172c844a725579", "exported_at": "2026-09-30T21:13:36.845Z", "scope": "Print reading edition. Research prose is retained; raster images and identified visual catalogues are replaced by source links. See editorial_scope for exact omissions. Support archive exports retain the core discussion and link the full gallery.", "editorial_scope": { "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.", "linked_sections": [], "raster_images_replaced": 0 }, "license": { "identifier": "CC0-1.0", "url": "https://creativecommons.org/publicdomain/zero/1.0/", "rights_statement_url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json", "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb", "application": "Authored research materials; third-party materials retain their own rights." }, "pdf": { "filename": "security_timeline.pdf", "url": "https://phishdestroy.io/steam_dossier/exports/pages/en/security_timeline.pdf?v=print-20260930-links-v6", "sha256": "2e393cbb76932855859aa815da6384ed43e056589b1cf26c80df80bbb696466e", "bytes": 91337, "pages": 6 }, "integrity": { "signed_object": "security_timeline.content.json", "scope": "The exact UTF-8 bytes of this JSON file. It contains the published text and identifies the corresponding PDF by SHA-256. It is distinct from the separately signed rights statement.", "signature_file": "security_timeline.content.json.asc", "digest_file": "security_timeline.content.json.sha256", "format": "ASCII-armored detached OpenPGP", "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01", "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt", "verify": [ "gpg --import pgp-key.txt", "gpg --verify security_timeline.content.json.asc security_timeline.content.json", "sha256sum -c security_timeline.content.json.sha256" ] }, "content": { "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nTHE SECURITY RECORDEXHIBIT / 16 ENTRIES\n\n2018 — 2026\n\nSecurity Timeline — 2018 to 2026\n\nSecurity changed. Follow the record.\n\nWHAT THIS SECTION PROVES\n\nThis chronological record reconstructs eight years of security modifications across Steam's trade and authentication stack. It tracks the 2018 7-day trade hold implementation, 2023 Web API key mobile confirmations, and the 2026 session token deprecations against documented bypass techniques. The timeline establishes that platform updates consistently lagged known exploit vectors while preserving structural advantages for commercial operators.\n\n← Back to Executive briefing\n\nTrade locks. Login controls. API restrictions. A dated record of what changed—and what the sources actually establish.\n\nExplore the timeline ↓\nEIGHT YEARS. ONE RECORD.16milestones to examine\n\nEvery entry keeps its submitted date and source. Verification is shown alongside it.\n\nREVIEWED / 24 SEP 2026\n10Verified event & date\n06Partly verified\n00Source mismatch\n00Source needed\nHow to read this record\n\nVerified event & date: both supported by a readable primary source. Partly verified: a related change is documented, but the date or scope remains unresolved. Source mismatch: the linked material does not support the submitted claim. Source needed: no matching dated source was verified in this review. An unresolved entry is not proof that an event did not happen.\n\nDates on unresolved entries are submitted dates, not verified release dates. The original investigation text has not been rewritten.\n\nThe chronology\n01 — 16\nSearch the recordTopicEvidenceOrder\n\n16 of 16 entries · newest first\n\n202609-01Submitted date\nCommunityPartly verified\nSuspicious-message warnings in group chats\n\nAn official beta notice confirms the feature on 31 August. The supplied 1 September stable-release date still needs its specific release note.\n\nSteam Client Beta — August 31st ↗archived 2026-03-13 ↗\nOriginal entry & submitted link\n\nAutomated Suspicious Chat Flagging\n\nInspect the submitted source ↗\n202601-16Verified date\nAPIVerified event & date\nGranular permissions & IP whitelisting for Publisher Keys (Valve announcement)\n\nOn 16 January 2026, Valve published an official Steamworks announcement (\"NEW: Better permissions and controls for Web API Keys\") confirming new granular permission tools allowing developers to segment Web API keys into discrete groups (General, Microtransactions, Economy, and Sales Data), restrict keys to specific App IDs, and enforce server IP whitelisting.\n\nThe Glaring Double Standard: This official announcement establishes that Valve has fully developed the technical infrastructure for granular API permissions and IP restrictions, but deliberately withholds them from regular user accounts (steamcommunity.com/dev/apikey). Regular user API keys remain monolithic, all-or-nothing credentials with no IP whitelisting—which is the exact technical omission enabling the multi-million-dollar API trade interception industry.\n\nValve Announcement — NEW: Better permissions and controls for Web API Keys (16 Jan 2026) ↗· Documentation: Steamworks Web API Authentication ↗\nOriginal entry & submitted link\n\nSteamworks Web API Granular Scopes\n\nInspect Valve's Official Steamworks Announcement (493839547938902179) ↗\n202507-15Verified date\nTradingVerified event & date\nCS2 trades gain a seven-day reversal window\n\nValve's dated announcement introduces reversal of Counter-Strike item trades from the preceding seven days. While designed to mitigate hijacking, third-party economic audits (CSMarketCap ↗) recorded a $104M (-25%) collapse in market capitalization within 24 hours due to cash-trading disruption. As analyzed by Skinvault ↗, triggering a reversal inflicts an automatic 30-day trade lockout on the account. In summer 2026, Valve shifted from global midnight UTC resets to individual per-item minute timers (Skin.land ↗).\n\nValve — 15 July 2025 announcement ↗· CSMarketCap Analysis ↗\nOriginal entry & submitted link\n\nCS2 Trade Protection / Reversal Window\n\nInspect the submitted source ↗\n202505-14Verified date\nAuthenticationVerified event & date\nValve publishes account security warning regarding SMS leaks\n\nValve's official announcement on May 14, 2025, addresses account security and SMS-based authenticators. While the notice focuses on SMS leaks and confirms no Steam systems were breached, it serves as an official security update on the submitted date.\n\nValve — A note about the security of your Steam account ↗\nOriginal entry & submitted link\n\nAccount Security Announcement\n\nInspect the submitted source ↗\n202410-02Verified date\nTradingVerified event & date\nSeven days before re-trading or re-marketing\n\nThe release notes cover items acquired through the in-game store, including the Armory, trade offers and the Community Market. The documented scope is wider than Armory items alone.\n\nValve — Release Notes for 10/2/2024 ↗\nOriginal entry & submitted link\n\nCS2 The Armory / 7-Day Hold\n\nInspect the submitted source ↗\n202409-18Submitted date\nTradingPartly verified\nNew-device restrictions verified on Help Pages\n\nSteam's official support documentation confirms a 7-day trading restriction when logging in from a new device that has not been authorized for at least 7 days. While the exact rollout date of September 18, 2024, is not recorded as a changelog milestone, the functionality is fully documented.\n\nSteam Support — Trading and Market Restrictions ↗\nOriginal entry & submitted link\n\nNew Device Login Trade Restriction\n\nInspect the submitted source ↗\n202402-14Submitted date\nCommunityPartly verified\nName-change trade cooldown implemented in 2024\n\nCommunity and developer records confirm that in early 2024, Valve introduced an unannounced 2-to-4 hour trade cooldown immediately following a profile name change to mitigate rapid impersonation scams. Because Valve published no official press release, client changelog, or support article for this restriction, the submitted February 14 date lacks formal verification; a Steam community discussion serves as indirect corroboration rather than official Valve documentation.\n\nSteam community discussion (indirect corroboration) — Name-change restriction detail ↗\nOriginal entry & submitted link\n\nProfile Name / Avatar Change Hold\n\nInspect the submitted source ↗\n202312-04Verified date\nAPIVerified event & date\nKey creation requires mobile confirmation\n\nThe introduction of mandatory Steam Guard mobile confirmation for Web API key creation is verified to have occurred in late 2023, as documented by third-party developer libraries. The exact date of December 4, 2023, represents the observed rollout period within the developer community.\n\nMaintainer documentation — March 2024 ↗archived 2026-09-24 ↗\nOriginal entry & submitted link\n\nMobile Confirmation for API Keys\n\nInspect the submitted source ↗\n202310-24Verified date\nDeveloperVerified event & date\nMandatory 2FA for setting game builds live goes effective\n\nValve's official Steamworks announcement on October 10, 2023, confirms that starting October 24, 2023, any account setting a build live on the default branch of a released application must authorize the change via SMS or the Steam Mobile App. This change directly updated the SetAppBuildLive Web API.\n\nSteamworks — Security improvements for managing builds and users ↗archived 2025-12-03 ↗\nOriginal entry & submitted link\n\nSMS MFA for Game Build Publications\n\nInspect the submitted source ↗\n202307-12Submitted date\nCommunityPartly verified\nCustom biography content warnings observed by community\n\nSteam community reports starting in July 2023 document that custom profile biographies containing external links or trigger words began displaying automated content warnings. The submitted date of July 12, 2023, matches the initial wave of user reports on Steam Community forums.\n\nSteam Community Forum — Bio Content Warning Reports ↗\nOriginal entry & submitted link\n\nCustom Biography Content Warning\n\nInspect the submitted source ↗\n202301-25Submitted date\nCommunityPartly verified\nProfile link filtering and editing cooldowns active\n\nSteam's official support documentation confirms that links in custom biographies are filtered, and abusive name or avatar changes can trigger editing bans. While the exact rollout of the 4-hour cooldown on January 25, 2023, represents the observed onset, the link-filtering mechanism itself is fully active on the submitted help page.\n\nSteam Support — Profile Name and Avatar Restrictions ↗\nOriginal entry & submitted link\n\nProfile LINK REMOVED / Cooldown\n\nInspect the submitted source ↗\n202210-24Verified date\nAuthenticationVerified event & date\nSteam Client transition to OAuth refresh and access tokens\n\nValve's major client and mobile app updates in October 2022 overhauled the Steam authentication system. The old session cookie structure was replaced with OAuth-based access and refresh tokens, and a list of active authorized devices was introduced to allow manual revocation of active sessions.\n\nValve — Steam Mobile App Update and Authentication Overhaul ↗\nOriginal entry & submitted link\n\nSteam Login Overhaul / Cookie Truncation\n\nInspect Valve Announcement ↗\n202210-12Verified date\nAuthenticationVerified event & date\nQR sign-in and authorized-device management\n\nValve's 12 October announcement describes QR sign-in, approval or denial of sign-ins, and a device list that can revoke account access.\n\nValve — The updated Steam Mobile App is now available ↗\nOriginal entry & submitted link\n\nSteam Mobile App 3.0 / QR Login\n\nInspect the submitted source ↗\n202205-10Submitted date\nAPIPartly verified\nTrade cancellation endpoints removed from public API list\n\nDeveloper records confirm that in May 2022, Valve silently removed trade management endpoints such as IEconService/CancelTradeOffer and DeclineTradeOffer from the Web API (documented in node-steam-tradeoffer-manager #325). While the methods remain functional in private client protocols, the date of May 10, 2022, represents their observed removal from public Web APIs to combat scam panels.\n\nDeveloper Discussion — Issue #325 (CancelTradeOffer removed) ↗· Steamworks Web API — IEconService Documentation ↗\nOriginal entry & submitted link\n\nRemoval of Trade Cancellation Endpoints\n\nInspect node-steam-tradeoffer-manager Issue #325 ↗\n202005-25Verified date\nTradingVerified event & date\nDota 2 items receive a seven-day trading cooldown\n\nOn May 25, 2020, alongside the International 10 Battle Pass release (blog.dota2.com/2020/05/the-international-10-battle-pass/), Valve implemented a 7-day trade lock on Dota 2 items, matching the 2018 Counter-Strike policy. This restriction applies to all traded items and Market purchases.\n\nDota 2 Community — Trade Lock and TI10 Client Update ↗\nOriginal entry & submitted link\n\nDota 2 / 7-Day Trade Lock\n\nInspect the submitted source ↗\n201803-29Verified date\nTradingVerified event & date\nTraded CS:GO items receive a seven-day cooldown\n\nThe official release notes confirm the date and restriction. The supplied URL redirected to a 2013 map update; the matching release-note URL ends in 20309.\n\nValve — Release Notes for 3/29/2018 ↗\nOriginal entry & submitted link\n\nCS:GO / 7-Day Trade Lock\n\nInspect the submitted source ↗ archived 2025-02-26 ↗\n\nFollow the evidence. Inspect the source.\n\nReturn to the investigation ↗", "headings": [ { "level": 1, "id": null, "text": "Security Timeline — 2018 to 2026" }, { "level": 2, "id": null, "text": "The chronology" }, { "level": 2, "id": null, "text": "Suspicious-message warnings in group chats" }, { "level": 2, "id": null, "text": "Granular permissions & IP whitelisting for Publisher Keys (Valve announcement)" }, { "level": 2, "id": null, "text": "CS2 trades gain a seven-day reversal window" }, { "level": 2, "id": null, "text": "Valve publishes account security warning regarding SMS leaks" }, { "level": 2, "id": null, "text": "Seven days before re-trading or re-marketing" }, { "level": 2, "id": null, "text": "New-device restrictions verified on Help Pages" }, { "level": 2, "id": null, "text": "Name-change trade cooldown implemented in 2024" }, { "level": 2, "id": null, "text": "Key creation requires mobile confirmation" }, { "level": 2, "id": null, "text": "Mandatory 2FA for setting game builds live goes effective" }, { "level": 2, "id": null, "text": "Custom biography content warnings observed by community" }, { "level": 2, "id": null, "text": "Profile link filtering and editing cooldowns active" }, { "level": 2, "id": null, "text": "Steam Client transition to OAuth refresh and access tokens" }, { "level": 2, "id": null, "text": "QR sign-in and authorized-device management" }, { "level": 2, "id": null, "text": "Trade cancellation endpoints removed from public API list" }, { "level": 2, "id": null, "text": "Dota 2 items receive a seven-day trading cooldown" }, { "level": 2, "id": null, "text": "Traded CS:GO items receive a seven-day cooldown" } ], "links": [ "https://phishdestroy.io/steam_dossier/de/security_timeline.html", "https://phishdestroy.io/steam_dossier/de/#briefing-heading", "https://steamcommunity.com/groups/SteamClientBeta?l=english", "https://web.archive.org/web/20260313235409/https://steamcommunity.com/groups/SteamClientBeta?l=english", "https://store.steampowered.com/news/posts/?enddate=1788390000", "https://steamcommunity.com/groups/steamworks/announcements/detail/493839547938902179", "https://partner.steamgames.com/doc/webapi_overview/auth", "https://csmarketcap.com/blog/market-insights/from-boom-to-bust-cs2s-trade-protection-impact", "https://skinvault.gg/blog/cs2-trade-protection-explained/", "https://skin.land/blog/steam-changes-cs2-trade-ban-logic-timing/", "https://store.steampowered.com/news/posts/?appids=730&enddate=1753924057&feed=steam_announce%2F1000", "https://help.steampowered.com/faqs/view/3041-A87A-E5F6-B6AC", "https://store.steampowered.com/news/posts/?enddate=1747349559", "https://steamcommunity.com/ogg/593110/announcements/detail/533224478739530146", "https://store.steampowered.com/news/posts/?appids=730&enddate=1728000977&feed=steam_community_announcements", "https://steamcommunity.com/games/CSGO/announcements/detail/4447966961421256740", "https://help.steampowered.com/faqs/view/7F77-9E92-31E0-6B8E", "https://steamcommunity.com/discussions/forum/1/4202490424033360096/", "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens", "https://web.archive.org/web/20260924181824/https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens", "https://steamcommunity.com/dev/apikey", "https://steamcommunity.com/groups/steamworks/announcements/detail/3749866608167579206", "https://web.archive.org/web/20251203174259/https://steamcommunity.com/groups/steamworks/announcements/detail/3749866608167579206", "https://steamcommunity.com/groups/steamworks/announcements/detail/3734103130194459461", "https://steamcommunity.com/discussions/forum/1/3807266184852932971/", "https://help.steampowered.com/faqs/view/225C-C51E-B8F0-55B2", "https://store.steampowered.com/news/group/4/view/3314112260640237775", "https://store.steampowered.com/news/posts/?appgroupname=Keep+in+touch&enddate=1666122699&feed=steam_blog", "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/issues/325", "https://partner.steamgames.com/doc/webapi/IEconService", "https://steamcommunity.com/app/570/announcements/", "https://blog.dota2.com/2020/05/trading-cooldown/", "https://blog.counter-strike.net/2018/03/20309/", "https://blog.counter-strike.net/index.php/2018/03/20308/", "https://web.archive.org/web/20250226114333/https://blog.counter-strike.net/index.php/2018/03/20308/", "https://phishdestroy.io/steam_dossier/de/#vulnerability-profile" ] } }