[breakingcups]

At this point, just leak it to Project Zero anonymously and let them wring Valve's hand for you.

There's a small chance you might still get the bounty, because you reported it first. And if not, because it's already disclosed by another party, you can cry foul on social media.