A contractor working for QR generation service Pageloot inadvertently exposed login credentials for the company's staging environment after storing them in a Google Doc with overly permissive sharing settings. The contractor set the document to "anyone with the link can view," which allowed Google Search to index the file once the link became discoverable on the public web. A Pageloot developer discovered the exposure when Google's autocomplete feature surfaced a staging hostname and credential string while debugging.
This incident reflects a broader pattern of accidental data exposure through collaboration tools. Japanese game developer Ateam left a Google Drive instance publicly accessible from March 2017 until November 2023, exposing 1,369 files and personal data for 935,779 people. Scale AI, a data-labeling company working with Meta, Google, and xAI, left 85 Google Docs with training material editable to anyone with a link. A 2022 scan by AI security company Metomic found that 40.2% of approximately 6.5 million Google Drive files contained sensitive information, with 0.5% fully public.
The technical root cause involves how Google indexes documents with link-based sharing permissions. While "anyone with the link" files are not automatically indexed, they become searchable once the link appears somewhere on the public web. This creates a false sense of security, as users assume link-only sharing provides meaningful access control. The problem extends beyond Google to other collaboration platforms like Trello, where government users exposed passwords and security plans through public boards in 2018.
Verizon's 2025 Data Breach Investigations Report attributes approximately 60% of breaches to human factors including misconfiguration and misuse of valid credentials. Pageloot also experienced a separate access control failure when a disgruntled former employee whose access had not been revoked redirected customer QR codes to a competitor's site. These incidents demonstrate that as collaboration tools become more complex, users struggle to maintain proper access controls.
Organizations should implement several protective measures. Use dedicated password managers for credential storage rather than shared documents. Ban password storage in collaboration tools like Google Docs, Slack, and Notion. Before sharing any document, verify exactly who will have access and what permissions they receive. Conduct regular audits of user access rights, especially when employees or contractors leave. These basic precautions can prevent credentials and sensitive data from becoming publicly searchable through collaboration platform misconfigurations.
Source: https://www.malwarebytes.com/blog/news/2026/08/be-careful-what-you-put-in-anyone-with-the-link-google-docs