TF2, CS:GO source code posted by disgruntled modder booted off Portal fan project
But no risk to player security, Valve insists.
This week, outdated source code for Valve's Team Fortress 2 and Counter-Strike: Global Offensive was posted in the public domain, causing concern it could be used to circumvent security in these games.
The code - dumped on 4chan - was old and outdated, and Valve was soon able to issue a pair of statements saying it had detected no threat to either of its games. But where had this source code come from, and why was it being spread online now?
According to Valve, this code was not only several years old, it had also been leaked before.
"We have reviewed the leaked code and believe it to be a reposting of a limited CS:GO engine code depot released to partners in late 2017, and originally leaked in 2018," Valve's Doug Lombardi told GameSpot. "From this review, we have not found any reason for players to be alarmed or avoid the current builds (as always, playing on the official servers is recommended for greatest security)."
It also, rather amusingly, includes developer notes from Valve employees chewing each other out over their bugs.
"This shit doesn't work! Why? Has I ever?," one snippet uncovered by Twitter user TailorTF reads (thanks, VG247). Says another: "Make the unbumped version not so fucking stupid and not need tangentSpaceTranspose you knob."
Curiously, the source code was not the only thing leaked. Also included was snippets of private communication from Valve fan Tyler MicVicker, creator of the Valve News Network site and various modding projects. These logs lay out Vicker's conversation with an anonymous Valve source, which Vicker saved and shared among close friends.
When all of the above leaked, Vicker was quick to distance himself from being responsible and able to immediately point to who was to blame, and why.
It all boils down to a former friend and colleague who worked on Lever Softworks, a team who ran a community server for Valve games that was also working on a recreation of cancelled project F-Stop, an unreleased Portal prequel. This friend was racist and transphobic, McVicker claims, and was this week removed from the group while McVicker was transferring ownership to someone else.
In a Twitch livestream last night, McVicker named this person as "Maxx", and said the leak had been a retaliation by this person for being kicked from the group, with the chat logs being included to ensure McVicker was implicated.
Speaking to me today, McVicker said Maxx's behaviour was "widely known" - and that the full picture had been made clear to Valve today.
McVicker's account is backed up by fellow project member Jaycie Erysdren, who held her own Q&A on Twitter last night.
We've contacted Valve to hear what its next steps will be.