bounty.index
/to search
Live data paused. Neon is grumpy. Programs still load from the upstream mirror; watchlists and alerts are taking a nap.
Featured on
Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates
programs/HackerOne/superhuman
Superhuman (formerly Grammarly)

HackerOne·30 in-scope · 2 out·updated 43m ago·RSS
Discord →open program
bountymanagedopen
first response
—
no reports yet
scope
2 out
asset mix
other
12 other · 10 url · 5 wildcard
last change
—
no history yet
In scope

030
wildcards05
Recent changes

— no diffs detected in snapshot history yet —
Community reports

0 reports
No reports yet — be the first to share your triage timing for Superhuman (formerly Grammarly).
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
Your notes

▸ raw source payload
{
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 93,
  "average_time_to_first_program_response": 1,
  "average_time_to_report_resolved": 4954,
  "handle": "superhuman",
  "id": 0,
  "managed_program": true,
  "name": "Superhuman (formerly Grammarly)",
  "offers_bounties": true,
  "offers_swag": false,
  "response_efficiency_percentage": 97,
  "submission_state": "open",
  "url": "https://hackerone.com/superhuman",
  "website": "https://superhuman.com/",
  "targets": {
    "in_scope": [
      {
        "asset_identifier": "*.coda.io",
        "asset_type": "WILDCARD",
        "availability_requirement": "low",
        "confidentiality_requirement": "low",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": "low",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "*.grammarly.com",
        "asset_type": "WILDCARD",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "*.grammarly.io",
        "asset_type": "WILDCARD",
        "availability_requirement": "low",
        "confidentiality_requirement": "low",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "",
        "integrity_requirement": "low",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "*.grammarlyaws.com",
        "asset_type": "WILDCARD",
        "availability_requirement": "low",
        "confidentiality_requirement": "low",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "",
        "integrity_requirement": "low",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "*.superhuman.com",
        "asset_type": "WILDCARD",
        "availability_requirement": "low",
        "confidentiality_requirement": "low",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "All subdomains of Superhuman.com - third party saas domains are excluded.",
        "integrity_requirement": "low",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "Capture the Flag",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": "not_defined",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "The first hacker who reports the `$FLAG` saved in the document (`document_id: 1198436185`) of the user `h1_ctf@grammarly.com` (`user_id: 1411519194`) will be awarded a **$100K bounty**.\n",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "Coda Chrome Extension",
        "asset_type": "OTHER",
        "availability_requirement": "low",
        "confidentiality_requirement": "low",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": "medium",
        "max_severity": "high"
      },
      {
        "asset_identifier": "Grammarly Browser Extensions",
        "asset_type": "OTHER",
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "The extension is available in the extension/add-on store of the respective browser: \n* [Chrome](https://chrome.google.com/webstore/detail/grammarly-for-chrome/kbfnbcaeplbcioakkpcpgfkobkghlhen?hl=en) \n* [Firefox](https://addons.mozilla.org/en-US/firefox/addon/grammarly-1/)\n* [Edge](https://microsoftedge.microsoft.com/addons/detail/grammarly-ai-writing-and/cnlefmmeadmemmdciolhbnfeacpdfbkd)\n* [Safari](https://apps.apple.com/us/app/grammarly-for-safari/id1462114288)\n\n**Browser Extension vulnerabilities will not be distinguished. For example, if a vulnerability exists in the Chrome and Safari extensions, we will consider it the same vulnerability and will only award one bounty.**",
        "integrity_requirement": "not_defined",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "Grammarly Desktop for Windows",
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "availability_requirement": null,
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "https://download-windows.grammarly.com/GrammarlyInstaller.exe",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "Grammarly Desktop for macOS",
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "availability_requirement": null,
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "https://download-mac.grammarly.com/Grammarly.dmg",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "Superhuman Go",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Superhuman Go is a proactive AI assistant that integrates with 100+ apps to coordinate agents and provide context-aware help across your workflow. It works in every tab where you work.\n[Superhuman Go - AI Assistant](https://superhuman.com/products/go-ai-assistant)\n",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "Superhuman Mail",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "none"
      },
      {
        "asset_identifier": "Superhuman Mail Chrome Extension",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "Superhuman Mail Desktop App",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "coda.grammarly.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "coda.io",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "codacontent.io",
        "asset_type": "URL",
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": "not_defined",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "codahosted.io",
        "asset_type": "URL",
        "availability_requirement": "low",
        "confidentiality_requirement": "low",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": "low",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "com.grammarly.android.keyboard",
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "[Grammarly for Android](https://www.grammarly.com/mobile/android).\n\nVulnerabilities with PoC may qualify for additional bounty via [Google Play Security Rewards Program](https://hackerone.com/googleplay). See [Vulnerability Criteria](https://hackerone.com/googleplay) for details.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "com.grammarly.keyboard",
        "asset_type": "APPLE_STORE_APP_ID",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "[Grammarly for iOS](https://www.grammarly.com/mobile/ios)",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "com.superhuman.mail",
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Superhuman Mail Android app\nhttps://play.google.com/store/apps/details?id=com.superhuman.mail&hl=en",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "com.superhuman.mail ",
        "asset_type": "APPLE_STORE_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Superhuman Mail iOS app\nhttps://apps.apple.com/us/app/superhuman-mail/id1120837655",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "docs.superhuman.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "gateway.superhuman.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "id.superhuman.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "io.coda",
        "asset_type": "APPLE_STORE_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "io.coda.codaapp",
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "mail.superhuman.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "settings.superhuman.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "superhuman.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "critical"
      }
    ],
    "out_of_scope": [
      {
        "asset_identifier": "Third party external services",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "- `send.grammarly.com`\n- `calendar.grammarly.com`\n- `support.grammarly.com`\n- `status.grammarly.com`\n- `brand.grammarly.com`\n- `partners.grammarly.com`\n- `events.grammarly.com`\n- `hello.superhuman.com`\n- `events.superhuman.com`\n- `engage.superhuman.com`\n\nAny submissions on these domains and their subdomains are out of scope for the bounty. This includes any SaaS that is not controlled by Superhuman, even if it is not mentioned here.",
        "integrity_requirement": null,
        "max_severity": "none"
      },
      {
        "asset_identifier": "status.coda.io",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": null,
        "integrity_requirement": null,
        "max_severity": "none"
      }
    ]
  }
}
+*.grammarly.io· critical