{"id":"4750c0c7-8f36-4a1c-ac18-49768252439b","engagementId":"81029a57-3ab8-42a5-93b5-b994aec714f1","data":{"brief":{"id":"ccf87353-0457-4307-8805-c8c4b897be58","name":"CoinDesk Data - Data API ","tagline":"CoinDesk Data is a central authority for clear and concise information, offering unrivalled breadth, scope and depth of data, bridging the gap between the crypto asset and traditional financial markets.","description":"\u003cp\u003eFounded in 2014, CryptoCompare, now CoinDesk Data, is a global cryptocurrency market data provider, giving institutional and retail investors access to real-time, high-quality, reliable market and pricing data on 5,300+ coins and 240,000+ currency pairs. By aggregating and analyzing tick data from globally recognized exchanges, and seamlessly integrating different datasets in the cryptocurrency price, CoinDesk Data provides a comprehensive, holistic overview of the market. At a granular level, we produce: cryptocurrency trade data, order book data, blockchain and historical data, social data, reports and a suite of cryptocurrency indices.\u003c/p\u003e\n\n\u003cp\u003eWe pride ourselves on our data integrity and scope of data and we continually invest in our technology and API to ensure our infrastructure remains robust and both the retail and institutional investors can access data to execute their investment portfolios. CoinDesk Data adheres to the most rigorous standards to safeguard data integrity, normalising global sources to ensure consistency and confidence in the market. To ensure the integrity of our data, we regularly review crypto exchanges, monitor for market abuse and take regional anomalies and geographical movements into consideration.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eSeverity Level\u003c/th\u003e\n\u003cth\u003eCritical\u003c/th\u003e\n\u003cth\u003eHigh\u003c/th\u003e\n\u003cth\u003eMedium\u003c/th\u003e\n\u003cth\u003eLow\u003c/th\u003e\n\u003cth\u003eInformational\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eVRT\u003c/td\u003e\n\u003ctd\u003eP1\u003c/td\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003eP5\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eCVSS v3\u003c/td\u003e\n\u003ctd\u003e10.0-9.0\u003c/td\u003e\n\u003ctd\u003e8.9-7.0\u003c/td\u003e\n\u003ctd\u003e6.9-4.0\u003c/td\u003e\n\u003ctd\u003e\u0026lt;= 3.9 Low Impact\u003c/td\u003e\n\u003ctd\u003e\u0026lt;= 3.9 Informational\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eCoinDesk Data reserves the right to make any final determination of rating levels for any reported vulnerability.\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of CoinDesk Data not listed in the targets section is out of scope. This includes any/all subdomains not listed below. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to CoinDesk Data, you can report it to security.incident@bullish.com. However, be aware that it is ineligible for rewards or points-based compensation. Some of these targets are production systems so please exercise caution when testing. You can register for an account and create an API key at https://www.cryptocompare.com/.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003ePlease use your @bugcrowdninja.com email to sign up for an account to create an API key. An API key is required to access a majority of the functionality. \u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eUnauthorized access to any administrative or back-end functionality\u003c/li\u003e\n\u003cli\u003eAny vertical privilege escalation or access to user data\u003c/li\u003e\n\u003cli\u003ePlease focus all testing on the APIs themselves. The API documentation, other APIs, developers.coindesk.com, and all other endpoints are out of scope for this program.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDenial Of Service testing: Out of concern for the availability of our services to all users, please do not attempt to carry out DoS attacks against public or 3rd parties, leverage black hat SEO techniques, spam people, or engage in other behavior of a similar nature or with similar consequences\u003c/li\u003e\n\u003cli\u003eAny APIs or services discovered that are not included as part of https://data-api.coindesk.com/. All other sub-domains, APIs, and services are out of scope for this program\u003c/li\u003e\n\u003cli\u003eURL redirection: We recognize that the address bar is the only reliable security indicator in modern browsers; consequently, we hold that the usability and security benefits of a small number of well ­designed and closely monitored redirectors outweigh their true risks.\u003c/li\u003e\n\u003cli\u003e\"Coin Scams\": There are always scams present attempting to misappropriate real money, crypto currency and personal information. Except where such efforts infringe on a legally protected mark or identity We have no ability to intervene and therefore cannot pay bounties on such reports.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e for clarification before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"3209e827-1e0e-441d-99b1-9462c887a4f8","name":"In Scope","targets":[{"id":"3eb4c9f4-4e14-49a3-898a-45e0d124bd97","uri":"http://data-api.coindesk.com/","name":"CoinDesk Data - Data API","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e246f13f-c5a5-4f33-b44d-f479cf3aa99a","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"3eb4c9f4-4e14-49a3-898a-45e0d124bd97"}],"recentChangeFlags":null},{"id":"727db3f9-5c98-41f8-9f91-1a6e889fe907","uri":"https://tools-api.cryptocompare.com/","name":"CoinDesk Data - Tools API","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4ae99cb1-e134-444c-9c85-75f2ba54c4c4","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"9756141b-4864-4843-8371-1e407083badc","p1MaxCents":750000,"p1MinCents":350000,"p2MaxCents":350000,"p2MinCents":150000,"p3MaxCents":150000,"p3MinCents":50000,"p4MaxCents":50000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eTarget Information\u003c/h2\u003e\n\n\u003cp\u003eOur Digital Asset Data REST API is a reliable, accurate, and efficient tool in the digital asset industry. We\u0026#39;ve combined our rich legacy of crypto data ingestion and processing (we\u0026#39;ve been doing this since January 2013) with state-of-the-art technology to provide you with seamless access to the world of digital assets. Whether you\u0026#39;re an institutional investor, an emerging startup, or a tech enthusiast, our API serves as your trusted guide in the ever-evolving digital asset space.\u003c/p\u003e\n\n\u003ch2\u003eDocumentation\u003c/h2\u003e\n\n\u003cp\u003eAvailable documentation on our API  can be found \u003ca href=\"https://developers.coindesk.com/documentation/data-api/introduction\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e \u003c/p\u003e","rewardRangeData":{"1":{"min":3500,"max":7500},"2":{"min":1500,"max":3500},"3":{"min":500,"max":1500},"4":{"min":250,"max":500},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"4d5681b5-45d1-4c72-badf-3a5c47dbfdd3","name":"Out of Scope targets","targets":[{"id":"996ae4e9-d701-410b-867c-d969cf04cf41","uri":"https://www.coindesk.com/","name":"coindesk.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6155475c-5ea0-403e-aa0d-6a01c0457bd2","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"b47badcb-17e9-439e-ae8a-94d99b07aa31","uri":"https://uat.coindesk.com/","name":"uat.coindesk.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"63d21771-140e-4fd1-8ca7-d66ee0e3c20d","sortOrder":1},"sortOrder":1,"tags":[{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"b47badcb-17e9-439e-ae8a-94d99b07aa31"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"b47badcb-17e9-439e-ae8a-94d99b07aa31"},{"id":"a634fd4f-7410-4f25-9d18-31f9ce752854","name":"CSS","targetId":"b47badcb-17e9-439e-ae8a-94d99b07aa31"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b47badcb-17e9-439e-ae8a-94d99b07aa31"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"b47badcb-17e9-439e-ae8a-94d99b07aa31"}],"recentChangeFlags":null},{"id":"6c842daa-0491-4654-8f42-5c1408814096","uri":"https://events.coindesk.com","name":"Production CoinDesk Events","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"26bc223c-e7f3-483d-93cb-8ee710e214c7","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"a9e07b41-35a5-45fb-b381-ef6eba717ce1","uri":"https://consensus2025.coindesk.com/","name":"Consensus2025 Site","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e7e352d3-3a8c-4e47-8894-32407ea15001","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"129d9b86-10a3-4118-87a5-8e319588f802","uri":"https://consensus-hongkong2025.coindesk.com/","name":"Consensus HK Site","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7b6e5678-6960-445a-84ff-8e6a1efe45e9","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"1a1046bd-f120-4859-b260-680910326c45","uri":"https://data.coindesk.com/","name":"data.coindesk.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"57a49051-6bd1-41cf-83df-d903e91e098e","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"66e4c48d-b065-45fa-9fa0-d15f76faaf9e","uri":"https://developers.coindesk.com","name":"developers.coindesk.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bbbcfe16-e77b-44d9-870d-acc19bb8d1ad","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eWhilst CCData are interested in vulnerabilities related to any of their services that are clearly and demonstrably related to CCData assets, the following sections and sub-domains are out of scope. \u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"81029a57-3ab8-42a5-93b5-b994aec714f1","code":"CCData-mbb-og","state":"in_progress","endsAt":null,"bountyId":"e78cfcd3-9ebe-4f03-8e48-1dcdc2ea19bc","startsAt":"2025-05-13T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/5df6/0999/bb477b9e/be7864877487e1a2f51c0b94f5324194_a6fc936fd1997f3d47d9e86a00982f28_Coindesk.jpg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-05-13T18:00:00.045Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/CCData-mbb-og","changelogs":"/engagements/CCData-mbb-og/changelog","submissions":null,"announcements":"/engagements/CCData-mbb-og/announcements","hallOfFame":"/engagements/CCData-mbb-og/hall_of_fames","crowdstream":"/engagements/CCData-mbb-og/crowdstream"},"announcementsCount":2,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/CCData-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=CCData-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/CCData-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/CCData-mbb-og/changelog","publishedAt":"2025-06-13T19:14:15.367Z","engagementChangelogUrl":"/engagements/CCData-mbb-og/changelog/4750c0c7-8f36-4a1c-ac18-49768252439b","createUserFeedbacksUrl":"/engagements/CCData-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/CCData-mbb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}