CoinDesk Data - Data API

Description

Founded in 2014, CryptoCompare, now CoinDesk Data, is a global cryptocurrency market data provider, giving institutional and retail investors access to real-time, high-quality, reliable market and pricing data on 5,300+ coins and 240,000+ currency pairs. By aggregating and analyzing tick data from globally recognized exchanges, and seamlessly integrating different datasets in the cryptocurrency price, CoinDesk Data provides a comprehensive, holistic overview of the market. At a granular level, we produce: cryptocurrency trade data, order book data, blockchain and historical data, social data, reports and a suite of cryptocurrency indices. We pride ourselves on our data integrity and scope of data and we continually invest in our technology and API to ensure our infrastructure remains robust and both the retail and institutional investors can access data to execute their investment portfolios. CoinDesk Data adheres to the most rigorous standards to safeguard data integrity, normalising global sources to ensure consistency and confidence in the market. To ensure the integrity of our data, we regularly review crypto exchanges, monitor for market abuse and take regional anomalies and geographical movements into consideration. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Severity Level │ Critical │ High │ Medium │ Low │ Informational VRT │ P1 │ P2 │ P3 │ P4 │ P5 CVSS v3 │ 10.0-9.0 │ 8.9-7.0 │ 6.9-4.0 │ <= 3.9 Low Impact │ <= 3.9 Informational CoinDesk Data reserves the right to make any final determination of rating levels for any reported vulnerability.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of CoinDesk Data not listed in the targets section is out of scope. This includes any/all subdomains not listed below. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to CoinDesk Data, you can report it to [email protected]. However, be aware that it is ineligible for rewards or points-based compensation. Some of these targets are production systems so please exercise caution when testing. You can register for an account and create an API key at https://www.cryptocompare.com/. Access: Please use your @bugcrowdninja.com email to sign up for an account to create an API key. An API key is required to access a majority of the functionality. Focus Areas: Unauthorized access to any administrative or back-end functionality Any vertical privilege escalation or access to user data Please focus all testing on the APIs themselves. The API documentation, other APIs, developers.coindesk.com, and all other endpoints are out of scope for this program. Out-of-Scope Denial Of Service testing: Out of concern for the availability of our services to all users, please do not attempt to carry out DoS attacks against public or 3rd parties, leverage black hat SEO techniques, spam people, or engage in other behavior of a similar nature or with similar consequences Any APIs or services discovered that are not included as part of https://data-api.coindesk.com/. All other sub-domains, APIs, and services are out of scope for this program URL redirection: We recognize that the address bar is the only reliable security indicator in modern browsers; consequently, we hold that the usability and security benefits of a small number of well ­designed and closely monitored redirectors outweigh their true risks. "Coin Scams": There are always scams present attempting to misappropriate real money, crypto currency and personal information. Except where such efforts infringe on a legally protected mark or identity We have no ability to intervene and therefore cannot pay bounties on such reports. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.

In Scope (in scope)

Target Information Our Digital Asset Data REST API is a reliable, accurate, and efficient tool in the digital asset industry. We've combined our rich legacy of crypto data ingestion and processing (we've been doing this since January 2013) with state-of-the-art technology to provide you with seamless access to the world of digital assets. Whether you're an institutional investor, an emerging startup, or a tech enthusiast, our API serves as your trusted guide in the ever-evolving digital asset space. Documentation Available documentation on our API can be found here

Out of Scope targets (out of scope)

Whilst CCData are interested in vulnerabilities related to any of their services that are clearly and demonstrably related to CCData assets, the following sections and sub-domains are out of scope.