H1 HackerOne LIVE
Superhuman (formerly Grammarly)
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://superhuman.com/
- managed triage
- yes
- response efficiency
- 96%
- first response
- 1h avg
- time to bounty
- 91h avg
29 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
coda.grammarly.com | domain | yes | critical | 2026-09-20 |
coda.io | domain | yes | critical | 2026-09-20 |
codacontent.io | domain | yes | critical | 2026-09-20 |
codahosted.io | domain | yes | critical | 2026-09-20 |
docs.superhuman.com | domain | yes | critical | 2026-09-20 |
gateway.superhuman.com | domain | yes | critical | 2026-09-20 |
id.superhuman.com | domain | yes | critical | 2026-09-20 |
mail.superhuman.com | domain | yes | critical | 2026-09-20 |
settings.superhuman.com | domain | yes | critical | 2026-09-20 |
superhuman.com | domain | yes | critical | 2026-09-20 |
Grammarly Desktop for Windows | executable | yes | critical | 2026-09-20 |
Grammarly Desktop for macOS | executable | yes | critical | 2026-09-20 |
com.grammarly.android.keyboard | mobile | yes | critical | 2026-09-20 |
com.grammarly.keyboard | mobile | yes | critical | 2026-09-20 |
com.superhuman.mail | mobile | yes | critical | 2026-09-20 |
io.coda | mobile | yes | critical | 2026-09-20 |
io.coda.codaapp | mobile | yes | critical | 2026-09-20 |
Capture the Flag | other | yes | critical | 2026-09-20 |
Coda Chrome Extension | other | yes | high | 2026-09-20 |
Grammarly Browser Extensions | other | yes | critical | 2026-09-20 |
Superhuman Go | other | yes | critical | 2026-09-20 |
Superhuman Mail | other | yes | none | 2026-09-20 |
Superhuman Mail Chrome Extension | other | yes | critical | 2026-09-20 |
Superhuman Mail Desktop App | other | yes | critical | 2026-09-20 |
*.coda.io | wildcard | yes | critical | 2026-09-20 |
*.grammarly.com | wildcard | yes | critical | 2026-09-20 |
*.grammarly.io | wildcard | yes | critical | 2026-09-20 |
*.grammarlyaws.com | wildcard | yes | critical | 2026-09-20 |
*.superhuman.com | wildcard | yes | critical | 2026-09-20 |
2 out of scope — black ICE, don't touch
status.coda.iodomainThird party external servicesother
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.