Contractor's public Google Doc leaked a marketing firm's staging credentials

QR-code marketing company Pageloot traced a credential leak back to a contractor who stored staging environment passwords in a Google Doc set to public visibility. Co-founder Siim Kostabi said an employee debugging an unrelated issue typed the company's domain into Google Search and saw a staging hostname followed by what looked like a credential string sitting in the autocomplete suggestions, the doc had been sitting there long enough for Google's crawler to index it.

The contractor needed the credentials reachable from multiple devices and picked a shared Google Doc over a password manager or vault, a shortcut that's easy to reach for on a team without a dedicated security review step to catch it. Pageloot revoked the contractor's access, rotated every credential the doc had exposed, and banned storing passwords in Google Docs, Slack, or Notion going forward.

Nothing about this failure is exotic. A doc shared as "anyone with the link" is a public URL like any other, and a search engine will crawl and index it exactly like it would a public blog post, autocomplete included. Any password manager with shared-vault support closes this specific gap for less friction than a shared doc, and most already plug into the same collaboration tools teams reach for instead.

For a small team, the fix isn't a tool, it's a policy that gets enforced before a credential ever lands somewhere search-indexable, because nothing in a Google Doc's default sharing flow is going to stop it once it does.