Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Superhuman (formerly Grammarly)

By Superhuman Bug bounty on HackerOne superhuman.com

Accepting reports Full safe harbor
Go to program Website
Top reward
$100,000
Top severity paid
Critical
Assets in scope
29
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $100,000
for critical bugs.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 2 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $100,000 from $2,500
High $5,000 from $1,000
Medium $1,250 from $500
Response
Within 2 days | Time to first response | 2 business days |
Safe harbor
Full Activities conducted in accordance with this policy will be considered authorized and exempt from legal action.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Earlier reward tables (1)
  • 12 Nov 2026 to 12 Nov 2026: Low up to $500

Scope

29 assets you may test, 2 excluded.

Web 10

  • codacontent.io Critical
  • coda.grammarly.com Critical
  • codahosted.io Critical
  • coda.io Critical
  • docs.superhuman.com Critical
  • gateway.superhuman.com Critical
  • id.superhuman.com Critical
  • mail.superhuman.com Critical
  • settings.superhuman.com Critical
  • superhuman.com Critical

Wildcard domains 5

  • *.coda.io Critical
  • *.grammarlyaws.com Critical
  • *.grammarly.com Critical
  • *.grammarly.io Critical
  • *.superhuman.com Critical

Android apps 3

  • com.grammarly.android.keyboard Critical
  • com.superhuman.mail Critical
  • io.coda.codaapp Critical

iOS apps 3

  • com.grammarly.keyboard Critical
  • com.superhuman.mail Critical
  • io.coda Critical

Desktop and binaries 2

  • Grammarly Desktop for macOS Critical
  • Grammarly Desktop for Windows Critical

Products and areas 6

  • Capture the Flag Critical
  • Coda Chrome Extension High
  • Grammarly Browser Extensions Critical
  • Superhuman Go Critical
  • Superhuman Mail Chrome Extension Critical
  • Superhuman Mail Desktop App Critical
Out of scope (2)
  • Third party external services
  • status.coda.io

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Superhuman (formerly Grammarly) (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Respect privacy — **only interact with test accounts** that you own.
  • Do **not** test or exploit bugs on real customer accounts.
  • **No DoS, spam, or abuse of customer support channels** to gain attention.
  • Do **not** use leaked customer credentials.
  • If you encounter user data inadvertently, stop testing immediately, report it, and purge all local data.
  • Submit one vulnerability per report (unless chaining is needed for impact).
  • Only the **first valid report** of a vulnerability will be rewarded.
  • Social engineering (phishing, vishing, smishing, etc.) is strictly prohibited.
  • Do **not** contact us through customer support channels or email.
  • Do not create more than **5 test accounts**.

Not accepted

  • Apparent SSRF of `/api/oembedResolve` (uses Iframely)
  • Clickjacking on non-sensitive pages
  • Unauthenticated, logout, or login CSRF without security impact
  • MITM, physical access, or pre-compromised device attacks
  • Known vulnerable libraries without a working PoC
  • CSV injection without demonstrated execution or data exfiltration
  • Missing SSL/TLS, DNS, CSP, or security headers without a working exploit
  • Content spoofing, self-XSS, or text injection without cross-user impact
  • DoS, stress testing, or service disruption attempts
  • Overly large payloads or resource-exhaustion issues in docs
  • Rate-limit issues on non-sensitive endpoints without demonstrated impact
  • Automated scanner output without manual validation
  • Broken links, harmless redirects, or other UX-only issues
  • Non-production or demo environment findings without sensitive data or production impact
  • “Best practice,” theoretical, or informational issues without a realistic exploit path
  • Credential reuse from public dumps or breach collections
  • Username or account enumeration without additional impact
  • Abuse of free trials, promo codes, referrals, invites, or credits
  • Account sharing or subscription misuse
  • Cosmetic paywall or feature-flag bypasses without material impact
  • Institutional or educational access-code issues
  • Email verification or password complexity complaints
  • AI model jailbreaks or safety-filter bypasses without an actual security impact
  • Duplicate or previously known issues

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Reward terms

    High $13,000 → $5,000, Medium $5,000 → $1,250

  2. Scope removed

    Superhuman Mail

  3. Scope removed

    app.grammarly.com

  4. Scope added

    docs.superhuman.com

  5. Scope added

    com.superhuman.mail

  6. Scope added

    mail.superhuman.com

  7. Scope added

    Superhuman Mail Chrome Extension

  8. Scope added

    Superhuman Mail Desktop App

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

🛡️ Superhuman (formerly Grammarly) Bug Bounty Program

Welcome, hackers 👋

Superhuman, formerly Grammarly, is an AI productivity platform bringing together four products: Grammarly, Superhuman Docs (formerly Coda), Superhuman Mail, and Superhuman Go.

Our previously separate bug bounty programs have been consolidated into one unified Superhuman Bug Bounty Program, providing researchers with a central place to test eligible assets and report security vulnerabilities across the Superhuman product suite.

We’re excited to continue working with the security research community to help protect our users, their data, and the systems powering Superhuman.

🌍 Our Story

Superhuman builds AI-powered productivity tools that help people communicate, create, and collaborate more effectively across Grammarly, Superhuman Docs, Superhuman Mail, and Superhuman Go.

Security and privacy are central to everything we build. We look forward to working with researchers worldwide to responsibly identify and resolve vulnerabilities across the Superhuman product suite.

🧭 Program Scope

In Scope

The Superhuman Bug Bounty Program covers eligible assets across Grammarly, Superhuman Docs, Superhuman Mail, and Superhuman Go, including:

  • *.grammarly.com
  • *.coda.io
  • *.superhuman.com
  • Browser extensions for Chrome, Safari, Firefox, and Edge
  • Desktop applications for macOS and Windows
  • Mobile applications and keyboards for Android and iOS

⏱️ Response Targets

Stage Target Timeframe
Time to first response 2 business days
Time to triage 4 business days
Time to bounty (after triage) 7 business days

We’ll keep you updated throughout the process.

🧩 Rules for Researchers

  • Be an ethical hacker and follow HackerOne’s disclosure guidelines.
  • Respect privacy — only interact with test accounts that you own.
  • Do not test or exploit bugs on real customer accounts. Doing so may reduce bounty awards by up to 50%.
  • No DoS, spam, or abuse of customer support channels to gain attention.
  • Do not use leaked customer credentials.
  • We will pay bounties for working employee credential leaks when properly demonstrated.
  • If you encounter user data inadvertently, stop testing immediately, report it, and purge all local data.
  • Submit one vulnerability per report (unless chaining is needed for impact).
  • Only the first valid report of a vulnerability will be rewarded.
  • Multiple issues stemming from the same root cause may be combined into one bounty.
  • Social engineering (phishing, vishing, smishing, etc.) is strictly prohibited.
  • Do not contact us through customer support channels or email. Any attempts to establish out-of-band communication will result in the report being closed as N/A and report to HackerOne.

🧪 Test Accounts

Create your own test accounts to explore and validate findings.

  • For Coda testing:

    • Create a free account at https://coda.io/welcome.
    • Use a Google or email+password sign-up.
    • Append hackeronetester to your email (e.g., [email protected]) if you’re not using a @wearehackerone.com domain.
    • Do not create more than 5 test accounts.
    • Use only the free plan — do not use fake payment data.

  • For Grammarly/Superhuman testing:

    • Use @wearehackerone.com to sign up.
    • Append hackeronetester to your email (e.g., [email protected]) if you’re not using a @wearehackerone.com domain.

  • For Superhuman Mail testing: Superhuman supports only Google-based workspaces (e.g., Gmail or custom Google Workspace inboxes) and Outlook workspaces. When creating your test account, include both hackeronetest and your HackerOne username in the email address — for example: [email protected]

Need a specific subscription level? Contact us, and we’ll provide access as needed. We are currently not providing free upgrades for testing. We will update when we plan to resume; please do not create support tickets requesting a subscription or related questions about bug bounties.

🚫 Out of Scope

When reporting, please consider exploitability and impact. The following are out of scope or non-qualifying unless a clear, reproducible security impact is demonstrated:

Technical Exclusions

  • Apparent SSRF of /api/oembedResolve (uses Iframely)
  • Clickjacking on non-sensitive pages
  • Unauthenticated, logout, or login CSRF without security impact
  • MITM, physical access, or pre-compromised device attacks
  • Known vulnerable libraries without a working PoC
  • CSV injection without demonstrated execution or data exfiltration
  • Missing SSL/TLS, DNS, CSP, or security headers without a working exploit
  • Content spoofing, self-XSS, or text injection without cross-user impact
  • DoS, stress testing, or service disruption attempts
  • Overly large payloads or resource-exhaustion issues in docs
  • Rate-limit issues on non-sensitive endpoints without demonstrated impact
  • Automated scanner output without manual validation
  • Broken links, harmless redirects, or other UX-only issues
  • Non-production or demo environment findings without sensitive data or production impact
  • “Best practice,” theoretical, or informational issues without a realistic exploit path

Business Logic & Policy Exclusions

  • Credential reuse from public dumps or breach collections
  • Username or account enumeration without additional impact
  • Abuse of free trials, promo codes, referrals, invites, or credits
  • Account sharing or subscription misuse
  • Cosmetic paywall or feature-flag bypasses without material impact
  • Institutional or educational access-code issues
  • Email verification or password complexity complaints
  • AI model jailbreaks or safety-filter bypasses without an actual security impact
  • Duplicate or previously known issues

💰 Rewards

We reward based on the impact and severity of the vulnerability.
Final bounty amounts are at the discretion of the Superhuman Security Team.

Bounty tiers for different products:

  • Grammarly - Upto $30k
  • Superhuman - Upto $13k
  • Superhuman docs (Formerly Coda) - Upto $3k

Duplicate reports (including known internal issues) will not be rewarded.
Multiple vulnerabilities from a single root cause may be combined into one payout.

⚑ CTF Challenge
The first hacker who reports the $FLAG saved in document ID 1198436185 under user [email protected] (user_id 1411519194) in Grammarly (Classic doc only) will earn a $100,000 bounty.
If it’s in scope, the challenge remains active — no need to ask for confirmation.

Legal

🛡️ Safe Harbor

We comply with HackerOne’s Golden Safe Harbor Standard.
Activities conducted in accordance with this policy will be considered authorized and exempt from legal action.

Learn more → Safe Harbor FAQ

Ineligible Participants

Former employees and contractors of Superhuman are ineligible for bug-bounty payments for 6 months after their employment ends.

Thank you for helping keep Superhuman, our users, and the broader community safe.
We deeply appreciate your skill, curiosity, and professionalism — together, we’re building something truly secure 🚀