Security & Responsible Disclosure

If you believe you have identified a security vulnerability in Overthink It, report it privately through the security or contact channel designated by Overthink It.

Security testing should be limited to activity reasonably necessary to demonstrate the suspected vulnerability.

Researchers should:

• Report vulnerabilities privately.
• Provide enough information for Overthink It to investigate and reproduce the issue.
• Avoid accessing unnecessary personal information.
• Avoid modifying or deleting data.
• Avoid disrupting Overthink It or its users.
• Stop testing once the vulnerability has been reasonably demonstrated.
• Give Overthink It a reasonable opportunity to investigate and address the vulnerability before publicly disclosing it.

Users and researchers must not use security testing as a justification to:

• Access another user's account without authorization.
• Obtain another person's password, authentication code, session credential, or recovery information.
• Access private messages or conversations unnecessarily.
• Access private Cases or other restricted user content unnecessarily.
• Download or retain unnecessary personal information.
• Modify or delete another user's content.
• Take over another user's account.
• Circumvent access controls.
• Bypass authentication or authorization controls beyond what is reasonably necessary to demonstrate the vulnerability.
• Deploy malware.
• Install persistent access mechanisms.
• Conduct phishing or credential theft.
• Conduct denial-of-service or other disruptive testing.
• Spam users or systems.
• Attack third-party systems through Overthink It.
• Threaten or harass users or Overthink It personnel.
• Use a vulnerability to obtain financial or other personal benefit.
• Publicly expose sensitive vulnerability information before reasonable coordination with Overthink It.

Overthink It may contain sensitive personal information, including private conversations, dating-related information, relationship discussions, photographs, profiles, and other user-submitted content.

If a vulnerability exposes information belonging to another person, researchers should:

1. Stop accessing the information once the vulnerability is reasonably demonstrated.
2. Access only the minimum information necessary to establish the issue.
3. Avoid copying or downloading unnecessary information.
4. Securely delete information obtained during testing when it is no longer necessary.
5. Inform Overthink It what categories of information may have been exposed.

Do not publish, sell, distribute, or otherwise redistribute another user's private information.

Overthink It is an 18+ service.

Because minors are not permitted to use Overthink It, researchers must not use security testing as a means to identify, locate, contact, or expose suspected minors.

Researchers must not intentionally:

• Target a suspected minor for security testing.
• Collect unnecessary information about a suspected minor.
• Access private communications involving a minor beyond what is strictly necessary to establish a vulnerability.
• Publish information identifying a suspected minor.
• Contact a suspected minor as part of vulnerability research.
• Use a vulnerability to facilitate contact with or exploitation of a minor.

If a vulnerability appears to expose information concerning a minor, report that fact promptly and privately to Overthink It.

Overthink It provides AI-powered features that may process user-submitted content.

Potential security vulnerabilities may involve:

• Unauthorized access to AI inputs or outputs.
• Prompt-injection vulnerabilities.
• Cross-user data exposure.
• Unauthorized access to uploaded screenshots or images.
• Exposure of private conversations.
• Exposure of private profile information.
• Circumvention of AI safety restrictions.
• Unauthorized access to internal systems or data.
• Manipulation of AI features to expose protected information.

Researchers should demonstrate such vulnerabilities using the minimum information and access reasonably necessary.

Do not intentionally use an AI vulnerability to obtain sensitive information belonging to another user.

Researchers may report vulnerabilities involving:

• Login systems.
• Authentication.
• Password recovery.
• Session management.
• Account verification.
• Authorization.
• Account takeover.
• Access-control failures.

Do not take permanent control of another person's account.

If temporary access is reasonably necessary to demonstrate an authentication vulnerability, stop once the issue has been established and report it privately.

If you discover that Overthink It unintentionally exposes:

• Personal information.
• Private messages.
• Conversation screenshots.
• Dating profiles.
• Case information.
• Account credentials.
• Authentication tokens.
• Location information.
• Uploaded files.
• AI inputs or outputs.
• Internal system information.
• Other confidential information.

do not redistribute the information.

Report the exposure privately and provide enough information for Overthink It to identify the affected system.

Overthink It allows certain features to process user-provided material, including conversation screenshots, profiles, photographs, text, and other uploads.

Researchers should not use vulnerabilities in upload or processing systems to:

• Access files belonging to other users.
• Retrieve private uploads.
• Extract unnecessary personal information.
• Circumvent content-access controls.
• Modify another user's uploaded material.
• Access information beyond what is reasonably necessary to demonstrate the vulnerability.

If an upload vulnerability exposes private information, stop testing after establishing the issue and report it privately.

Overthink It may depend on third-party providers for services such as:

• Hosting.
• Authentication.
• AI processing.
• Analytics.
• Communications.
• Security.
• Storage.
• Other infrastructure.

Do not use an Overthink It vulnerability to attack or compromise a third-party system.

If you believe an issue originates with a third-party service, provide the relevant information to Overthink It where appropriate.

Overthink It may coordinate with the applicable provider.

Please do not publicly disclose a vulnerability before giving Overthink It a reasonable opportunity to investigate and address it.

Premature disclosure may expose users to:

• Account compromise.
• Privacy violations.
• Data exposure.
• Fraud.
• Abuse of affected features.
• Exploitation by malicious actors.

Overthink It may request reasonable additional time when necessary to protect users or complete remediation.

A useful security report should include, when available:

• Description of the vulnerability.
• Affected feature or system.
• Steps reasonably necessary to reproduce the issue.
• Expected behavior.
• Actual behavior.
• Potential security impact.
• Relevant screenshots or technical evidence.
• Test-account information, if applicable.
• Information about whether personal data was exposed.

Do not include unnecessary:

• Passwords.
• Authentication codes.
• Session credentials.
• Financial credentials.
• Private conversations.
• Personal information unrelated to the vulnerability.

Overthink It may evaluate reported vulnerabilities based on factors such as:

• Number of users potentially affected.
• Type and sensitivity of information exposed.
• Ability to access another user's account.
• Ability to bypass authorization.
• Ability to execute unauthorized actions.
• Likelihood of exploitation.
• Whether exploitation requires user interaction.
• Whether private conversations or other highly sensitive information are exposed.
• Whether the vulnerability creates a significant child-safety or personal-safety risk.

Overthink It may prioritize reports involving active exploitation, account takeover, authentication bypass, or significant personal-data exposure.

Overthink It appreciates good-faith security research intended to improve the safety and reliability of the platform.

Reporting a vulnerability does not authorize activity that would otherwise violate the Terms of Service or applicable law.

Nothing in this Policy creates a contractual promise that Overthink It will provide compensation, legal immunity, or a particular response unless Overthink It separately agrees to those terms.

Overthink It uses reasonable security measures, but no online service can guarantee that every vulnerability will be prevented or discovered.

Users and researchers should report suspected vulnerabilities rather than exploiting them for personal investigation, retaliation, financial benefit, or unauthorized access.

Overthink It may preserve or disclose information relating to security incidents when reasonably necessary for:

• Security investigations.
• Fraud prevention.
• Protection of users.
• Legal compliance.
• Valid legal process.
• Emergency circumstances.

Such handling will be subject to applicable law and the Overthink It Privacy Policy.

When reporting a vulnerability, researchers should preserve only the information reasonably necessary to explain or reproduce the issue.

Do not retain unnecessary personal information, private conversations, credentials, or other sensitive material.

Overthink It may preserve relevant information when reasonably necessary for:

• Security investigation.
• Fraud prevention.
• User protection.
• Enforcement.
• Legal compliance.

After reporting a vulnerability, Overthink It may request additional information or clarification.

Researchers are encouraged to cooperate reasonably with efforts to:

• Reproduce the issue.
• Determine its scope.
• Identify affected systems.
• Assess potential user impact.
• Confirm remediation.

Researchers should not continue testing indefinitely after the vulnerability has been adequately demonstrated.

If you believe a vulnerability is actively being exploited, clearly identify that fact in your report.

Reports involving:

• Active account takeover.
• Unauthorized access to private information.
• Large-scale data exposure.
• Credential theft.
• Ongoing fraud.
• Significant security compromise.

may receive elevated priority.

Do not attempt to investigate an active attack by compromising additional accounts or systems yourself.

Do not use Overthink It as a pathway to access accounts, systems, or services that you are not authorized to access.

If a vulnerability could allow access to another service, demonstrate the issue using the minimum activity reasonably necessary and report it privately.

Do not continue testing against the third-party service after the vulnerability has been established.

Do not use vulnerability reports to:

• Harass Overthink It personnel.
• Threaten the company.
• Demand payment through coercion.
• Publicly shame employees.
• Fabricate vulnerabilities.
• Submit knowingly false technical claims.
• Attempt to obtain unauthorized benefits.

Good-faith reports that ultimately turn out to be incorrect are not automatically considered abuse.

Researchers remain responsible for complying with applicable law.

Nothing in this Policy authorizes:

• Unauthorized access.
• Theft of information.
• Fraud.
• Extortion.
• Destruction of data.
• Disruption of services.
• Other unlawful activity.

Overthink It does not waive any legal rights or remedies by publishing this Policy.

Overthink It may update this Security & Responsible Disclosure Policy as:

• Security practices develop.
• Platform features change.
• New threats emerge.
• Technology changes.
• Legal requirements change.
• Responsible-disclosure procedures mature.

The current version will be made available through Overthink It.

If you believe you have discovered a security vulnerability, report it privately through Overthink It's designated security or contact channel.

Provide enough information for Overthink It to investigate while avoiding unnecessary disclosure of sensitive information.

Do not publicly disclose the vulnerability before Overthink It has had a reasonable opportunity to investigate and respond.

Designated security / contact channel: [DESIGNATED SECURITY EMAIL / CHANNEL]