Ars Technica's Kyle Orland recently found a security issue with Valve's online marketplace, Steam. "Out of respect for the privacy of Steam's more than 50 million users", Ars didn't immediately publish the article. Instead, they contacted Valve.
Barely three hours after being notified, the exploit had been fixed. That's fast. But what's really interesting is that Valve kept their mouths shut the entire time, neither commenting to the site or even publicly admitting that the exploit had been discovered.
The full piece on Ars details how the exploit was discovered and how easy it was to do, while also raising the point that, by keeping quiet on the matter, Valve is potentially discouraging further acts of voluntary "white hat" security existence.
HTML holes exposed sensitive data for "private" Steam user accounts [Ars Technica]