Developer’s public Google Doc leaked staging credentials via Google Search autocomplete

The contractor moved credentials from a private note to a Google Doc set to be viewable by anyone with the link. This change made the document accessible to the broader internet, and Google’s crawler indexed its contents. As a result, the staging hostname and credential string surfaced in Google Search autocomplete when an employee typed the company domain. The exposure was discovered not through a direct link but via the search suggestion feature.

Addressing the leak required immediate action: the contractor’s access was terminated, all potentially compromised credentials were rotated, and a new policy prohibited storing passwords in any collaboration tool such as Google Docs, Slack, or Notion. These steps incurred operational costs, including time spent auditing systems, generating new secrets, and updating internal documentation. The effort also involved communicating the policy change to employees and contractors to prevent recurrence.

The mitigation stops working if documents remain publicly accessible or if access controls are not consistently enforced. Relying on the obscurity of a shared link fails because search engines will index any publicly available content, making it discoverable through autocomplete or regular queries. Similarly, if off-boarding procedures are lax, former contractors or employees could retain access to leaked credentials, negating the rotation effort.

The broader lesson is that credential management must treat collaboration tools as non-secure storage; secrets should reside in dedicated secret-management systems. Regular access reviews and prompt de-provisioning of contractors and employees are essential to limit the window of exposure. Without these practices, even minor conveniences like sharing a doc can lead to significant security incidents.