AI Weekly Malaysia

A contractor hired by Pageloot (a QR code marketing company) stored staging server credentials in a Google Doc set to 'anyone with the link,' which Google then indexed so the hostname and credential string appeared in search autocomplete. Pageloot co-founder Siim Kostabi says an employee discovered the leak while debugging something unrelated by typing their domain into Google Search. The company cut the contractor's access, rotated all exposed credentials, and banned storing passwords on Google Docs, Slack, Notion, or similar collaboration tools.

Why: If you hire contractors or work across devices, enforce a credential-sharing policy before this happens to you—specifically, prohibit shared docs, Slack, or Notion for passwords and require a password manager. The failure mode here is that 'anyone with the link' Google Docs get crawled and indexed by Google Search, turning an internal convenience into a publicly discoverable credential leak.