Overshare

Acceptable use

Scan applications you own.

Overshare points a scanner at a web application. That is a capability that is legitimate when you own the target and a criminal offence when you do not, so the boundary matters more than it does for most developer tools.

Under Australia's Criminal Code Act and the US Computer Fraud and Abuse Act, unauthorised access to a computer system is the offence. Good intent is not a defence. This applies to you when you run the CLI, and to us when we run a scan you submitted.

01

The short version

Scan applications you own, or that you have written permission to test. Nothing else.

02

What the scanner does by default

The default scan — the CLI, the GitHub Action, and the scan box on the website — is passive. It requests only what the application already serves to any member of the public: the page, its JavaScript bundles, its response headers, its TLS configuration, public DNS records, and certificate transparency logs.

It does not log in, does not send POST/PUT/PATCH/DELETE, does not brute-force paths or parameters, and does not use any credential it discovers.

That is why the default carries no authorisation requirement. It is not a licence to point it at anything you like for any purpose — see what is prohibited below.

03

Scan tiers and what each requires

A

Passive

Fetches what the app serves to any visitor.

AuthorisationNone.

B

Anon-key read

not implemented yet

Uses the client-side key the app already ships to every browser, to make the same read any visitor's browser could. This is the Row Level Security check.

AuthorisationThe owner must have submitted the app themselves, or given permission.

C

Authenticated

not implemented yet

Owner-supplied credentials, deeper probing.

AuthorisationWritten owner authorisation. Always. No exceptions.

When Tier B arrives, the discipline will be structural rather than conventional: single-row reads, rate limited, no writes, no enumeration. Prove the door is unlocked; do not walk through it.

04

Prohibited

  • Scanning an application you neither own nor have permission to test beyond a passive scan, at any tier.
  • Using Overshare as reconnaissance for an attack. Establishing what an application exposes in order to exploit it is unauthorised access, and the scan is evidence of intent.
  • Scan-then-pitch. Running a scan against someone else's application and contacting them to sell a fix reads as extortion regardless of how it was meant, and creates a written record of profiting from an unsolicited scan. We will not do this, and you may not do it with output from this tool.
  • Publishing findings about a third party's application without giving them private notice and reasonable time to fix it.
  • Using a discovered credential. A key found in a bundle is reported and redacted. Connecting to anything with it is unauthorised access to a system, and the fact that the key was carelessly published is not a defence.
  • Volumetric use. Automating Overshare to sweep large numbers of third-party applications. The rate limits are not the policy; this is.
  • Circumventing the SSRF protections to reach internal or private-network addresses. The --unsafe-allow-private-ips flag exists for scanning your own local test app and logs a warning saying so. Using it against infrastructure that is not yours is exactly the conduct the guard is there to prevent.
05

If you find something in someone else's application

It happens — you scan your own app and a shared dependency, a subdomain, or a misconfigured third-party service surfaces.

Disclose it privately to the owner, give them time to fix it, and publish nothing in the meantime. Do not offer them a paid fix in the same message.

06

What we do with scans submitted to the hosted service

  • Scan results are kept for 30 days and then deleted automatically.
  • Secrets are redacted before a result reaches a report, a log, or the database. Enough characters survive to identify which key it is, never enough to use it.
  • We do not contact the owners of scanned applications.
  • We do not sell scan data, and we do not use it to approach anyone commercially.

That result is a report on your public surface, it expires in 30 days, and if you want it gone sooner, ask.

07

Enforcement

We can decline or block scans, and we can rate-limit or ban clients. We would rather explain a boundary than enforce one, so if your use case sits near a line here, ask first.

08

Questions

Open an issue for anything that is not itself sensitive. For a suspected vulnerability in Overshare itself, follow the security policy in the repository rather than filing it publicly.

This document describes how the project expects its tool to be used. It is not legal advice, and it does not override the law in your jurisdiction, which may be stricter.

Methodology →Scan an app →