Passwords stored in public Google Doc then showed up in search results
PWNED Welcome, once again, to PWNED, the weekly column where we highlight others’ security failures. Hopefully, there’s a lesson in all this, but it could just be “stop shooting yourself in the foot.”
Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request.
Our story today comes courtesy of Siim Kostabi, co-founder of Pageloot, a company that provides QR codes businesses can use for marketing. Kostabi’s tale of tech terror reminds us that credentials, even for a staging server, have a lot of value in the wrong hands.
REG AD
He explains that his company brought in a contractor to help with some API integrations on the back end. That developer had the credentials for the staging environment and wanted to be able to view them across different devices they were using for the job.
REG AD
So what was the developer’s solution to the very common problem of keeping track of usernames and passwords? They could have chosen a password manager. They could have written the passwords down in a paper notebook and kept it hidden from prying eyes. They could have gotten a password tattoo. They could even have emailed the passwords to themselves and it would have been smarter than what they did.
Instead, the outside developer decided to store their password in a Google Doc. And they set that Google Doc to be viewable by anyone on the internet who had the link. And then, one day, an employee at the company found the Google Doc with the staging credentials in it because Google Search had indexed it and offered it as a search suggestion.
“A developer on our team was debugging something unrelated and typed our domain into Google Search,” Kostabi recalls. “The autocomplete surfaced one of our staging hostnames followed by what looked like a credential string. We checked, and there was a publicly accessible Docs URL.”
Yikes! Just imagine that not only are your company’s credentials available to anyone online, but they are indexed in Google Search for the world to find!
Once they discovered the problem, Kostabi’s company immediately cut access for that contractor and rotated all of its exposed credentials. They also set a new rule: no storing passwords on Google Docs, Slack, Notion, or other collaboration tools.
MORE CONTEXT
- IT department put sticky notes on the laptops to help employees log in
- Headteacher had the most guessable username-password combo you could imagine
- Talking smack about a doctor got him access to private medical files
- Law firm insisted on one password to rule them all
-
AI and ml Google buys crashed airline Spirit’s data at auction, because AI
-
AI and Ml Excel's Copilot function is headed for the Recycle Bin
-
DEVOPS GitHub has Issues as repo downloads hit 50% error rate
-
security Expired credit cards revived by researchers to make unauthorized payments
-
PUBLIC SECTOR Capita handed vital role in next pandemic despite civil service pension failures
-
software Microsoft MVP creates site to remind you of all the brands Redmond replaced - SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performance Next-gen systems double per-chip performance while cramming 3x as many into a rack
- Security Copilot tricked into telling reseachers how to hack itself How to social engineer an AI's reasoning engine
- AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token sales AI gateways look promising as companies struggle with model orchestration
- ai and ml Anthropic says text watermarking scheme relies on inconsequential words 'Shall I compare thee to a summer's afternoon' is the sort of thing this will make, and others look likely to adopt it
- AI and ML DeepSeek's innovative harness treats everything as a plug-in Chinese AI labs keep moving forward while US labs play defense
- Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
- Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
- Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
- Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
- Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career
- FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash another Word up
- GNOME can look like Windows – and Flashback can do it without extensions New 'Simple-taskbar' is an option, but there's a simpler, stabler way
- A moment of silence, please, for the final release of Debian on x86-32 New Debian versions hit FOSSland in the form of 13.6 and 12.15
- Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites Flaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide
- Frame: A new X11 server – implemented directly in assembly Joins yserver, Phoenix, and of course XLibre – and outlier Arcan
- Cinnamon 6.8 will support Wayland – if you want it Next version of Linux Mint’s desktop has both kinds of display server
In a separate incident, Kostabi heard from a Pageloot customer, a mid-size retailer, whose QR codes were suddenly directing users to a competitor’s site. After investigating, he found that a disgruntled ex-employee’s credentials had not been revoked and that the former employee had used that access to redirect all of the retailer’s URLs, costing it customers.
The takeaway from both of these problems is that you need to carefully control access. Former employees should immediately lose access to everything and current contractors should be reasonably intelligent people you can trust.
“Both situations were completely avoidable with basic hygiene,” Kostabi said. “Proper offboarding, access reviews, and not treating shared docs like private vaults.” ®
[](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F08%2F13%2Fpasswords-stored-in-public-google-doc-then-showed-up-in-search-results%2F5287028) [](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F08%2F13%2Fpasswords-stored-in-public-google-doc-then-showed-up-in-search-results%2F5287028) [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F08%2F13%2Fpasswords-stored-in-public-google-doc-then-showed-up-in-search-results%2F5287028) [](https://bsky.app/intent/compose?text=Passwords%20stored%20in%20public%20Google%20Doc%20then%20showed%20up%20in%20search%20results%0Ahttps%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F08%2F13%2Fpasswords-stored-in-public-google-doc-then-showed-up-in-search-results%2F5287028) [](https://www.reddit.com/submit?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F08%2F13%2Fpasswords-stored-in-public-google-doc-then-showed-up-in-search-results%2F5287028&title=Passwords%20stored%20in%20public%20Google%20Doc%20then%20showed%20up%20in%20search%20results) [](https://api.whatsapp.com/send?text=Passwords%20stored%20in%20public%20Google%20Doc%20then%20showed%20up%20in%20search%20results%0Ahttps%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F08%2F13%2Fpasswords-stored-in-public-google-doc-then-showed-up-in-search-results%2F5287028)
REG AD