Skip to content
Sign in

Bug bounty program

SF

Superhuman (formerly Grammarly)

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
29
Disclosed reports
23
Subdomains
1,024

Most upvoted reports23

All reports
Most upvoted reports of Superhuman (formerly Grammarly)
ReportWeaknessDisclosedBountyVotes
Employee's GitHub Token Found In Travis CI Build LogsAnalysed#496937Information Disclosure2019-05-22$5,000408
Account takeover through the combination of cookie manipulation and XSSAnalysed#534450Cross-site Scripting2019-12-03–292
Ability to DOS any organization's SSO and open up the door to account takeoversAnalysed#976603Authentication2021-04-15$10,500260
Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into stateAnalysed#1082847Input Validation and Logic2021-03-01–223
Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originAnalysed#389108No weakness recorded2019-08-01–202
Previously created sessions continue being valid after MFA activationAnalysed#667739Access Control2019-08-19–176
`socket` command allows sending data over WebSockets to arbitrary origins from Grammarly ExtensionAnalysed#395729No weakness recorded2019-07-15–140
Lack of CSRF header validation at https://g-mail.grammarly.com/profileAnalysed#629892Information Disclosure2019-10-31–140
Unauthenticated users can access all food.grammarly.io user's dataAnalysed#745495Access Control2020-08-10–138
Lack or Origin check leads to Cross-Site Websocket Hijacking (CSWSH)Analysed#535436Access Control2020-01-04$800134

Subdomains1,024

Root
Scope
Name suggests:Sign-in
First seen
Text fileClear filters36 names
Subdomains of Superhuman (formerly Grammarly)
NameScopeFirst seen
auth.coda.ioauthIn scope2026-11-14
auth.head.coda.ioauthIn scope2026-11-14
auth.adhoc.coda.ioauthIn scope2026-11-14
packs-auth.coda.ioauthIn scope2026-11-14
auth.staging.coda.ioauth, stagingIn scope2026-11-14
packs-auth.dev.coda.ioauth, devIn scope2026-11-14
packs-auth.head.coda.ioauthIn scope2026-11-14
packs-auth.adhoc.coda.ioauthIn scope2026-11-14
packs.auth.adhoc.coda.ioauthIn scope2026-11-14
forking.auth.adhoc.coda.ioauthIn scope2026-11-14
huayang.auth.adhoc.coda.ioauthIn scope2026-11-14
packs-auth.staging.coda.ioauth, stagingIn scope2026-11-14
v1packs.auth.adhoc.coda.ioauthIn scope2026-11-14
redirect.auth.adhoc.coda.ioauthIn scope2026-11-14
packs-eval.auth.adhoc.coda.ioauthIn scope2026-11-14
pagelayout.auth.adhoc.coda.ioauthIn scope2026-11-14
multicolumn.auth.adhoc.coda.ioauthIn scope2026-11-14
parent.packs-auth.adhoc.coda.ioauthIn scope2026-11-14
huayang.packs-auth.adhoc.coda.ioauthIn scope2026-11-14
pagelayout.packs-auth.adhoc.coda.ioauthIn scope2026-11-14
multicolumn.packs-auth.adhoc.coda.ioauthIn scope2026-11-14
sso.grammarly.comauthIn scope2026-11-14
auth.grammarly.comauthIn scope2026-11-14
login.grammarly.comauthIn scope2026-11-14
auth-secure.grammarly.comauthIn scope2026-11-14
sso.private.grammarly.comauth, internalIn scope2026-11-14
auth-private.grammarly.comauth, internalIn scope2026-11-14
auth.private.grammarly.comauth, internalIn scope2026-11-14
login-static.grammarly.comauthIn scope2026-11-14
private.login.grammarly.comauth, internalIn scope2026-11-14
sso-institutions.grammarly.comauthIn scope2026-11-14
login.femetrics.grammarly.ioauthIn scope2026-11-14
gnar-zeppelin-identity.grammarly.ioauthIn scope2026-11-14
gnar-zeppelin-identity.emr.grammarly.ioauthIn scope2026-11-14
gnar-zeppelin-identity-spark.grammarly.ioauthIn scope2026-11-14
gnar-zeppelin-identity-spark.emr.grammarly.ioauthIn scope2026-11-14

1,023 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in