Google Doc Mishap Exposes Company Credentials

A security incident involving a Google Doc has underscored the risks associated with misconfigured sharing settings. Sensitive company credentials, intended for internal use, were inadvertently exposed and became discoverable through Google Search autocomplete after a contractor stored them in a Google Doc set to "Anyone with the link."

The incident, reported by The Register, involved Siim Kostabi, co-founder of Pageloot, a company providing QR codes for businesses. Pageloot had engaged an external contractor for back-end API integrations. This contractor needed access to credentials for the company's staging environment, a test version of its system. To facilitate access across multiple devices, the contractor placed the credentials in a Google Doc and set its sharing permission to allow anyone with the link to view it.

Subsequently, a Pageloot developer, while working on an unrelated issue, typed the company's domain into Google Search. The search engine's autocomplete feature surfaced one of the staging hostnames alongside what appeared to be a credential string. An investigation confirmed the existence of an accessible Google Docs URL containing the sensitive information.

Pageloot promptly revoked the contractor's access and rotated the exposed credentials. The company also implemented a policy prohibiting the storage of passwords in collaboration tools like Google Docs, Slack, or Notion.

Google has stated that Google Docs are restricted by default, and the document creator controls sharing settings. Google's guidance indicates that "Restricted" means only specifically invited individuals can open a file. The "Anyone with the link" setting allows any recipient of the link to access the file without logging into a Google Account. A separate "Public" setting, when available, permits anyone to find a file via Google Search.

Google clarified that links to publicly shared documents may be indexed if posted in public spaces accessible by search engine crawlers. The Register report noted that the Pageloot document appeared via Google Search autocomplete, but the exact method of discovery by Google's crawler was not detailed. The incident serves as a reminder for users to carefully review sharing settings before storing any sensitive information in cloud-based documents.

In a separate but related issue, Kostabi also described an incident where a customer of Pageloot discovered its QR codes were redirecting shoppers to a competitor's website. This occurred because a former employee's credentials had not been revoked, allowing them to alter the retailer's URLs. This highlights the importance of revoking access for individuals once they no longer require it, a principle applicable to both professional and personal contexts.

Users are advised to move passwords out of documents and into reputable password managers. Regularly checking the sharing permissions on important Google Docs, especially those containing financial or account details, is also recommended. On desktop, users can find this information by opening Google Drive, selecting the file, clicking "Share," reviewing the listed individuals under "Access," and checking the "General access" setting, which should ideally be set to "Restricted."

For mobile devices, users can open the Google Drive app, select the file, tap "Manage access," and under "General access," tap "Change" to set it to "Restricted."

Google has also addressed privacy concerns regarding its AI models, stating that private Workspace content, including data from Drive and Docs, is not used to train its foundational AI models like Gemini without explicit permission. This policy is separate from the credential exposure incident, which was a result of document sharing configurations and credential management.