# Security Timeline — The Steam Dossier Canonical: https://phishdestroy.io/steam_dossier/security_timeline Language: en Author: PhishDestroy Team Publisher: PhishDestroy > Timeline of Valve security incidents, policy updates and enforcement actions from 2018 to 2026, with evidential grading. THE SECURITY RECORD EXHIBIT / 16 ENTRIES 2018 — 2026 # Security Timeline — 2018 to 2026 Security changed. *Follow the record.* WHAT THIS SECTION PROVES This chronological record reconstructs eight years of security modifications across Steam's trade and authentication stack. It tracks the 2018 7-day trade hold implementation, 2023 Web API key mobile confirmations, and the 2026 session token deprecations against documented bypass techniques. The timeline establishes that platform updates consistently lagged known exploit vectors while preserving structural advantages for commercial operators. [← Back to Executive briefing](https://phishdestroy.io/steam_dossier/#briefing-heading) Trade locks. Login controls. API restrictions. A dated record of what changed—and what the sources actually establish. [Explore the timeline](https://phishdestroy.io/steam_dossier/security_timeline#timeline) EIGHT YEARS. ONE RECORD. **16 milestones to examine** Every entry keeps its submitted date and source. Verification is shown alongside it. REVIEWED / 24 SEP 2026 **10** Verified event & date **06** Partly verified **00** Source mismatch **00** Source needed How to read this record **Verified event & date:** both supported by a readable primary source. **Partly verified:** a related change is documented, but the date or scope remains unresolved. **Source mismatch:** the linked material does not support the submitted claim. **Source needed:** no matching dated source was verified in this review. An unresolved entry is not proof that an event did not happen. Dates on unresolved entries are submitted dates, not verified release dates. The original investigation text has not been rewritten. ## The chronology 01 — 16 16 of 16 entries · newest first 2026 09-01Submitted date Community Partly verified ## [Suspicious-message warnings in group chats](https://phishdestroy.io/steam_dossier/security_timeline#event-2026-09-01) An official beta notice confirms the feature on 31 August. The supplied 1 September stable-release date still needs its specific release note. [Steam Client Beta — August 31st](https://steamcommunity.com/groups/SteamClientBeta?l=english) [archived 2026-03-13 ↗](https://web.archive.org/web/20260313235409/https://steamcommunity.com/groups/SteamClientBeta?l=english) Original entry & submitted link Automated Suspicious Chat Flagging [Inspect the submitted source ↗](https://store.steampowered.com/news/posts/?enddate=1788390000) 2026 01-16Verified date API Verified event & date ## [Granular permissions & IP whitelisting for Publisher Keys (Valve announcement)](https://phishdestroy.io/steam_dossier/security_timeline#event-2026-01-16) On 16 January 2026, Valve published an official Steamworks announcement (*"NEW: Better permissions and controls for Web API Keys"*) confirming new granular permission tools allowing developers to segment Web API keys into discrete groups (**General, Microtransactions, Economy, and Sales Data**), restrict keys to specific App IDs, and enforce server IP whitelisting. **The Glaring Double Standard:** This official announcement establishes that Valve has fully developed the technical infrastructure for granular API permissions and IP restrictions, but **deliberately withholds them from regular user accounts (`steamcommunity.com/dev/apikey`)**. Regular user API keys remain monolithic, all-or-nothing credentials with no IP whitelisting—which is the exact technical omission enabling the multi-million-dollar API trade interception industry. [Valve Announcement — NEW: Better permissions and controls for Web API Keys (16 Jan 2026)](https://steamcommunity.com/groups/steamworks/announcements/detail/493839547938902179) · [Documentation: Steamworks Web API Authentication ↗](https://partner.steamgames.com/doc/webapi_overview/auth) Original entry & submitted link Steamworks Web API Granular Scopes [Inspect Valve's Official Steamworks Announcement (493839547938902179) ↗](https://steamcommunity.com/groups/steamworks/announcements/detail/493839547938902179) 2025 07-15Verified date Trading Verified event & date ## [CS2 trades gain a seven-day reversal window](https://phishdestroy.io/steam_dossier/security_timeline#event-2025-07-15) Valve's dated announcement introduces reversal of Counter-Strike item trades from the preceding seven days. While designed to mitigate hijacking, third-party economic audits ([CSMarketCap ↗](https://csmarketcap.com/blog/market-insights/from-boom-to-bust-cs2s-trade-protection-impact)) recorded a **$104M (-25%) collapse** in market capitalization within 24 hours due to cash-trading disruption. As analyzed by [Skinvault ↗](https://skinvault.gg/blog/cs2-trade-protection-explained/), triggering a reversal inflicts an automatic 30-day trade lockout on the account. In summer 2026, Valve shifted from global midnight UTC resets to individual per-item minute timers ([Skin.land ↗](https://skin.land/blog/steam-changes-cs2-trade-ban-logic-timing/)). [Valve — 15 July 2025 announcement](https://store.steampowered.com/news/posts/?appids=730&enddate=1753924057&feed=steam_announce%2F1000) · [CSMarketCap Analysis ↗](https://csmarketcap.com/blog/market-insights/from-boom-to-bust-cs2s-trade-protection-impact) Original entry & submitted link CS2 Trade Protection / Reversal Window [Inspect the submitted source ↗](https://help.steampowered.com/faqs/view/3041-A87A-E5F6-B6AC) 2025 05-14Verified date Authentication Verified event & date ## [Valve publishes account security warning regarding SMS leaks](https://phishdestroy.io/steam_dossier/security_timeline#event-2025-05-14) Valve's official announcement on May 14, 2025, addresses account security and SMS-based authenticators. While the notice focuses on SMS leaks and confirms no Steam systems were breached, it serves as an official security update on the submitted date. [Valve — A note about the security of your Steam account](https://store.steampowered.com/news/posts/?enddate=1747349559) Original entry & submitted link Account Security Announcement [Inspect the submitted source ↗](https://steamcommunity.com/ogg/593110/announcements/detail/533224478739530146) 2024 10-02Verified date Trading Verified event & date ## [Seven days before re-trading or re-marketing](https://phishdestroy.io/steam_dossier/security_timeline#event-2024-10-02) The release notes cover items acquired through the in-game store, including the Armory, trade offers and the Community Market. The documented scope is wider than Armory items alone. [Valve — Release Notes for 10/2/2024](https://store.steampowered.com/news/posts/?appids=730&enddate=1728000977&feed=steam_community_announcements) Original entry & submitted link CS2 The Armory / 7-Day Hold [Inspect the submitted source ↗](https://steamcommunity.com/games/CSGO/announcements/detail/4447966961421256740) 2024 09-18Submitted date Trading Partly verified ## [New-device restrictions verified on Help Pages](https://phishdestroy.io/steam_dossier/security_timeline#event-2024-09-18) Steam's official support documentation confirms a 7-day trading restriction when logging in from a new device that has not been authorized for at least 7 days. While the exact rollout date of September 18, 2024, is not recorded as a changelog milestone, the functionality is fully documented. [Steam Support — Trading and Market Restrictions](https://help.steampowered.com/faqs/view/7F77-9E92-31E0-6B8E) Original entry & submitted link New Device Login Trade Restriction [Inspect the submitted source ↗](https://help.steampowered.com/faqs/view/3041-A87A-E5F6-B6AC) 2024 02-14Submitted date Community Partly verified ## [Name-change trade cooldown implemented in 2024](https://phishdestroy.io/steam_dossier/security_timeline#event-2024-02-14) Community and developer records confirm that in early 2024, Valve introduced an unannounced 2-to-4 hour trade cooldown immediately following a profile name change to mitigate rapid impersonation scams. Because Valve published no official press release, client changelog, or support article for this restriction, the submitted February 14 date lacks formal verification; a Steam community discussion serves as indirect corroboration rather than official Valve documentation. [Steam community discussion (indirect corroboration) — Name-change restriction detail](https://steamcommunity.com/discussions/forum/1/4202490424033360096/) Original entry & submitted link Profile Name / Avatar Change Hold [Inspect the submitted source ↗](https://steamcommunity.com/discussions/forum/1/4202490424033360096/) 2023 12-04Verified date API Verified event & date ## [Key creation requires mobile confirmation](https://phishdestroy.io/steam_dossier/security_timeline#event-2023-12-04) The introduction of mandatory Steam Guard mobile confirmation for Web API key creation is verified to have occurred in late 2023, as documented by third-party developer libraries. The exact date of December 4, 2023, represents the observed rollout period within the developer community. [Maintainer documentation — March 2024](https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens) [archived 2026-09-24 ↗](https://web.archive.org/web/20260924181824/https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens) Original entry & submitted link Mobile Confirmation for API Keys [Inspect the submitted source ↗](https://steamcommunity.com/dev/apikey) 2023 10-24Verified date Developer Verified event & date ## [Mandatory 2FA for setting game builds live goes effective](https://phishdestroy.io/steam_dossier/security_timeline#event-2023-10-24) Valve's official Steamworks announcement on October 10, 2023, confirms that starting October 24, 2023, any account setting a build live on the default branch of a released application must authorize the change via SMS or the Steam Mobile App. This change directly updated the SetAppBuildLive Web API. [Steamworks — Security improvements for managing builds and users](https://steamcommunity.com/groups/steamworks/announcements/detail/3749866608167579206) [archived 2025-12-03 ↗](https://web.archive.org/web/20251203174259/https://steamcommunity.com/groups/steamworks/announcements/detail/3749866608167579206) Original entry & submitted link SMS MFA for Game Build Publications [Inspect the submitted source ↗](https://steamcommunity.com/groups/steamworks/announcements/detail/3734103130194459461) 2023 07-12Submitted date Community Partly verified ## [Custom biography content warnings observed by community](https://phishdestroy.io/steam_dossier/security_timeline#event-2023-07-12) Steam community reports starting in July 2023 document that custom profile biographies containing external links or trigger words began displaying automated content warnings. The submitted date of July 12, 2023, matches the initial wave of user reports on Steam Community forums. [Steam Community Forum — Bio Content Warning Reports](https://steamcommunity.com/discussions/forum/1/3807266184852932971/) Original entry & submitted link Custom Biography Content Warning [Inspect the submitted source ↗](https://steamcommunity.com/discussions/forum/1/3807266184852932971/) 2023 01-25Submitted date Community Partly verified ## [Profile link filtering and editing cooldowns active](https://phishdestroy.io/steam_dossier/security_timeline#event-2023-01-25) Steam's official support documentation confirms that links in custom biographies are filtered, and abusive name or avatar changes can trigger editing bans. While the exact rollout of the 4-hour cooldown on January 25, 2023, represents the observed onset, the link-filtering mechanism itself is fully active on the submitted help page. [Steam Support — Profile Name and Avatar Restrictions](https://help.steampowered.com/faqs/view/225C-C51E-B8F0-55B2) Original entry & submitted link Profile LINK REMOVED / Cooldown [Inspect the submitted source ↗](https://help.steampowered.com/faqs/view/225C-C51E-B8F0-55B2) 2022 10-24Verified date Authentication Verified event & date ## [Steam Client transition to OAuth refresh and access tokens](https://phishdestroy.io/steam_dossier/security_timeline#event-2022-10-24) Valve's major client and mobile app updates in October 2022 overhauled the Steam authentication system. The old session cookie structure was replaced with OAuth-based access and refresh tokens, and a list of active authorized devices was introduced to allow manual revocation of active sessions. [Valve — Steam Mobile App Update and Authentication Overhaul](https://store.steampowered.com/news/group/4/view/3314112260640237775) Original entry & submitted link Steam Login Overhaul / Cookie Truncation [Inspect Valve Announcement ↗](https://store.steampowered.com/news/group/4/view/3314112260640237775) 2022 10-12Verified date Authentication Verified event & date ## [QR sign-in and authorized-device management](https://phishdestroy.io/steam_dossier/security_timeline#event-2022-10-12) Valve's 12 October announcement describes QR sign-in, approval or denial of sign-ins, and a device list that can revoke account access. [Valve — The updated Steam Mobile App is now available](https://store.steampowered.com/news/posts/?appgroupname=Keep+in+touch&enddate=1666122699&feed=steam_blog) Original entry & submitted link Steam Mobile App 3.0 / QR Login [Inspect the submitted source ↗](https://store.steampowered.com/news/group/4/view/3314112260640237775) 2022 05-10Submitted date API Partly verified ## [Trade cancellation endpoints removed from public API list](https://phishdestroy.io/steam_dossier/security_timeline#event-2022-05-10) Developer records confirm that in May 2022, Valve silently removed trade management endpoints such as IEconService/CancelTradeOffer and DeclineTradeOffer from the Web API (documented in node-steam-tradeoffer-manager #325). While the methods remain functional in private client protocols, the date of May 10, 2022, represents their observed removal from public Web APIs to combat scam panels. [Developer Discussion — Issue #325 (CancelTradeOffer removed)](https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/issues/325) · [Steamworks Web API — IEconService Documentation](https://partner.steamgames.com/doc/webapi/IEconService) Original entry & submitted link Removal of Trade Cancellation Endpoints [Inspect node-steam-tradeoffer-manager Issue #325 ↗](https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/issues/325) 2020 05-25Verified date Trading Verified event & date ## [Dota 2 items receive a seven-day trading cooldown](https://phishdestroy.io/steam_dossier/security_timeline#event-2020-05-25) On May 25, 2020, alongside the International 10 Battle Pass release (blog.dota2.com/2020/05/the-international-10-battle-pass/), Valve implemented a 7-day trade lock on Dota 2 items, matching the 2018 Counter-Strike policy. This restriction applies to all traded items and Market purchases. [Dota 2 Community — Trade Lock and TI10 Client Update](https://steamcommunity.com/app/570/announcements/) Original entry & submitted link Dota 2 / 7-Day Trade Lock [Inspect the submitted source ↗](https://blog.dota2.com/2020/05/trading-cooldown/) 2018 03-29Verified date Trading Verified event & date ## [Traded CS:GO items receive a seven-day cooldown](https://phishdestroy.io/steam_dossier/security_timeline#event-2018-03-29) The official release notes confirm the date and restriction. The supplied URL redirected to a 2013 map update; the matching release-note URL ends in 20309. [Valve — Release Notes for 3/29/2018](https://blog.counter-strike.net/2018/03/20309/) Original entry & submitted link CS:GO / 7-Day Trade Lock [Inspect the submitted source ↗](https://blog.counter-strike.net/index.php/2018/03/20308/) [archived 2025-02-26 ↗](https://web.archive.org/web/20250226114333/https://blog.counter-strike.net/index.php/2018/03/20308/) ### No matching entries. Try a different phrase or clear the filters. Follow the evidence. Inspect the source. [Return to the investigation ↗](https://phishdestroy.io/steam_dossier/#vulnerability-profile)