1.7M DiRT 3 keys leaked from AMD promo due to missing .htaccess

I don't know how they'll resolve this...

Ban all the steam accounts of people who've activated the keys? They'll get a whole lot of people who legitimately submitted hardware keys at the same time.

Invalidate/revoke the keys from steam? The hardware IDs they were using to run the promotion are still going to be out there in the wild, so they can't re-run the promotion, this would just minimize their losses in terms of lost profit.

As far as the keys being in plain text on the server, this doesn't even make sense from the perspective of how you design a web app; why not put the data on a separate remote/secure server? Why not at least encrypt it? Also, how are they matching the hardware IDs to the keys when people submit the official promo; are they actually doing a search through each text file to find the matching hardware key? The .htaccess mis-configuration is bad enough, but it's not the only issue here.

Keys on the left activate on Steam. I'd personally recommend against using one, although they are supposed to be consumed by the public (they're available if you enter your details, it's not as if these were supposed to be charged for) if AMD request it Steam will revoke them and it has the potential to put your account in bad standing (although v. unlikely)

This is really not the proper way to report a vulnerability.

The other piece that everybody seems to be missing is that they've just leaked the unique IDs for every eligible AMD product. I don't know if those can be abused in some manner, but those are out there too, now.

Mine worked, thanks I guess? Already own the game for XB360.