Passwords in Google Doc Exposed via Search

A company experienced a critical security lapse when a contractor stored sensitive credentials in a Google Doc with 'anyone with the link' access. This document, intended for convenience, was later indexed by Google Search. The exposure came to light when a developer noticed a credential string appearing in Google Search autocomplete related to the company's domain.

Following the discovery of the compromised Google Doc, the company promptly revoked the contractor's access and rotated the exposed passwords. This incident serves as a stark reminder of the potential dangers associated with misconfigured sharing settings on cloud-based documents. Google emphasizes that documents are restricted by default and users control sharing permissions.

Further highlighting security oversights, a separate case involved a former employee redirecting a retailer's QR codes due to unrevoked credentials. Both situations underscore the importance of regularly reviewing and revoking access to shared files and accounts when they are no longer needed, emphasizing a principle of access having an expiration date.