Passwords stored in public Google Doc then showed up in search results
- ID
- 13772
- Status
- summarized
- Published
- 13 Aug 2026, 3:00 PM
- Fetched
- 13 Aug 2026, 3:20 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/13/passwords-stored-in-public-google-doc-then-showed-up-in-search-results/5287028
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 5.5
- Created
- 13 Aug 2026, 3:20 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
A contractor hired by Pageloot (a QR code marketing company) stored staging server credentials in a Google Doc set to 'anyone with the link,' which Google then indexed so the hostname and credential string appeared in search autocomplete. Pageloot co-founder Siim Kostabi says an employee discovered the leak while debugging something unrelated by typing their domain into Google Search. The company cut the contractor's access, rotated all exposed credentials, and banned storing passwords on Google Docs, Slack, Notion, or similar collaboration tools.
Why it matters
If you hire contractors or work across devices, enforce a credential-sharing policy before this happens to you—specifically, prohibit shared docs, Slack, or Notion for passwords and require a password manager. The failure mode here is that 'anyone with the link' Google Docs get crawled and indexed by Google Search, turning an internal convenience into a publicly discoverable credential leak.
Discussion angle
What's your actual enforced policy for contractor credential access—do you issue shared password manager vaults, or are you relying on the honor system and hoping nobody pastes a password into a shared doc?