# CoinGecko: bug bounty program on HackenProof

> CoinGecko is a bug bounty program on HackenProof. 6 assets are listed in scope, 6 of them bounty-eligible.

- **Company:** CoinGecko
- **Platform:** HackenProof
- **Program page:** https://hackenproof.com/programs/coingecko
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** July 22, 2020
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/coingecko

## Scope

As imported from HackenProof on October 21, 2026: 6 assets in scope (6 bounty-eligible), 14 out of scope. The policy page is the authority.

- `api.geckoterminal.com` (URL): in scope, bounty-eligible, max severity critical
- `coingecko.com` (URL): in scope, bounty-eligible, max severity critical
- `geckoterminal.com` (URL): in scope, bounty-eligible, max severity critical
- `https://apps.apple.com/us/app/coingecko-bitcoin-crypto-app/id1390323960` (URL): in scope, bounty-eligible, max severity critical
- `https://play.google.com/store/apps/details?id=com.coingecko.coingeckoapp` (URL): in scope, bounty-eligible, max severity critical
- `https://www.coingecko.com/en/api` (URL): in scope, bounty-eligible, max severity critical
- `ads.coingecko.com` (URL): out of scope
- `adsmanager.coingecko.com` (URL): out of scope
- `assets.coingecko.com` (URL): out of scope
- `http://pro-api.coingecko.com/api/v3/x402/*` (URL): out of scope
- `https://blog.coingecko.com` (URL): out of scope
- `https://chrome.google.com/webstore/detail/coingecko-candy-collector/ogdmacmpiojggeojaapfapjljcodigah` (URL): out of scope
- `https://mcp.api.coingecko.com` (URL): out of scope
- `https://mcp.pro-api.coingecko.com` (URL): out of scope
- `https://partner.coingecko.com` (URL): out of scope
- `https://support.coingecko.com` (URL): out of scope
- `landing.coingecko.com` (URL): out of scope
- `newsletter.coingecko.com` (URL): out of scope
- `selfserve.coingecko.com` (URL): out of scope
- `store.coingecko.com` (URL): out of scope

---

Generated October 23, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.