Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
29 in-scope
*.coda.ioscope· critical*.grammarly.comscope· critical*.grammarly.ioscope· critical*.grammarlyaws.comscope· critical*.superhuman.comscope· criticalcoda.grammarly.com· criticalcoda.io· criticalcodacontent.io· criticalcodahosted.io· criticaldocs.superhuman.com· criticalgateway.superhuman.com· criticalid.superhuman.com· criticalmail.superhuman.com· criticalsettings.superhuman.com· criticalsuperhuman.com· criticalcom.grammarly.keyboard· criticalcom.superhuman.mail· criticalio.coda· criticalCapture the Flag· criticalCoda Chrome Extension· highGrammarly Browser Extensions· criticalGrammarly Desktop for Windows· criticalGrammarly Desktop for macOS· criticalSuperhuman Go· criticalSuperhuman Mail Chrome Extension· criticalSuperhuman Mail Desktop App· criticalcom.grammarly.android.keyboard· criticalcom.superhuman.mail· criticalio.coda.codaapp· criticalThird party external services− removed 1 scope · Superhuman Mail
22d ago
+ added 1 scope · docs.superhuman.com
− removed 1 scope · app.grammarly.com
80d ago
+ added 2 scopes · com.superhuman.mail, com.superhuman.mail
90d ago
first indexed
92d ago · 28 in-scope assets
No reports yet. Be the first to share your triage timing for Superhuman (formerly Grammarly).
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/superhuman",
"name": "Superhuman (formerly Grammarly)",
"handle": "superhuman",
"targets": {
"in_scope": [
{
"asset_type": "WILDCARD",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "*.coda.io",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.grammarly.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.grammarly.io",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.grammarlyaws.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "WILDCARD",
"instruction": "All subdomains of Superhuman.com - third party saas domains are excluded.",
"max_severity": "critical",
"asset_identifier": "*.superhuman.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "OTHER",
"instruction": "The first hacker who reports the `$FLAG` saved in the document (`document_id: 1198436185`) of the user `h1_ctf@grammarly.com` (`user_id: 1411519194`) will be awarded a **$100K bounty**.\n",
"max_severity": "critical",
"asset_identifier": "Capture the Flag",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "high",
"asset_identifier": "Coda Chrome Extension",
"eligible_for_bounty": true,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "OTHER",
"instruction": "The extension is available in the extension/add-on store of the respective browser: \n* [Chrome](https://chrome.google.com/webstore/detail/grammarly-for-chrome/kbfnbcaeplbcioakkpcpgfkobkghlhen?hl=en) \n* [Firefox](https://addons.mozilla.org/en-US/firefox/addon/grammarly-1/)\n* [Edge](https://microsoftedge.microsoft.com/addons/detail/grammarly-ai-writing-and/cnlefmmeadmemmdciolhbnfeacpdfbkd)\n* [Safari](https://apps.apple.com/us/app/grammarly-for-safari/id1462114288)\n\n**Browser Extension vulnerabilities will not be distinguished. For example, if a vulnerability exists in the Chrome and Safari extensions, we will consider it the same vulnerability and will only award one bounty.**",
"max_severity": "critical",
"asset_identifier": "Grammarly Browser Extensions",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "DOWNLOADABLE_EXECUTABLES",
"instruction": "https://download-windows.grammarly.com/GrammarlyInstaller.exe",
"max_severity": "critical",
"asset_identifier": "Grammarly Desktop for Windows",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": "high"
},
{
"asset_type": "DOWNLOADABLE_EXECUTABLES",
"instruction": "https://download-mac.grammarly.com/Grammarly.dmg",
"max_severity": "critical",
"asset_identifier": "Grammarly Desktop for macOS",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": "high"
},
{
"asset_type": "OTHER",
"instruction": "Superhuman Go is a proactive AI assistant that integrates with 100+ apps to coordinate agents and provide context-aware help across your workflow. It works in every tab where you work.\n[Superhuman Go - AI Assistant](https://superhuman.com/products/go-ai-assistant)\n",
"max_severity": "critical",
"asset_identifier": "Superhuman Go",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "Superhuman Mail Chrome Extension",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "Superhuman Mail Desktop App",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "coda.grammarly.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "coda.io",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "codacontent.io",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "codahosted.io",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "[Grammarly for Android](https://www.grammarly.com/mobile/android).\n\nVulnerabilities with PoC may qualify for additional bounty via [Google Play Security Rewards Program](https://hackerone.com/googleplay). See [Vulnerability Criteria](https://hackerone.com/googleplay) for details.",
"max_severity": "critical",
"asset_identifier": "com.grammarly.android.keyboard",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "[Grammarly for iOS](https://www.grammarly.com/mobile/ios)",
"max_severity": "critical",
"asset_identifier": "com.grammarly.keyboard",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "Superhuman Mail Android app\nhttps://play.google.com/store/apps/details?id=com.superhuman.mail&hl=en",
"max_severity": "critical",
"asset_identifier": "com.superhuman.mail",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "Superhuman Mail iOS app\nhttps://apps.apple.com/us/app/superhuman-mail/id1120837655",
"max_severity": "critical",
"asset_identifier": "com.superhuman.mail ",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "docs.superhuman.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "gateway.superhuman.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "id.superhuman.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "io.coda",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "io.coda.codaapp",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "mail.superhuman.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "settings.superhuman.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "superhuman.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "OTHER",
"instruction": "- `send.grammarly.com`\n- `calendar.grammarly.com`\n- `support.grammarly.com`\n- `status.grammarly.com`\n- `brand.grammarly.com`\n- `partners.grammarly.com`\n- `events.grammarly.com`\n- `hello.superhuman.com`\n- `events.superhuman.com`\n- `engage.superhuman.com`\n- `help.superhuman.com`\n- Issues on Authorship/blackboard service\n\nAny submissions on these domains and their subdomains are out of scope for the bounty. This includes any SaaS that is not controlled by Superhuman, even if it is not mentioned here.",
"max_severity": "none",
"asset_identifier": "Third party external services",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "status.coda.io",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "https://superhuman.com/",
"offers_swag": false,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 98,
"response_efficiency_percentage": 88,
"average_time_to_report_resolved": 5043,
"average_time_to_first_program_response": 1
}