Contractor's Mistake Exposes Sensitive Login Details Online

Pageloot, a QR generation service, recently learned that a contractor's mistake exposed its staging environment login details in a Google Doc. The document was set to 'anyone with the link can view', allowing anyone who stumbled upon it to access sensitive information.

Google Search indexed the document, and when a developer typed the company's domain into Google while debugging, the autocomplete feature surfaced a staging hostname followed by what looked like a credential string. This exposed the credentials file online.

Pageloot was quick to respond, cutting the contractor's access and changing affected credentials. The company also banned password storage in shared workspaces.

This incident highlights the importance of being cautious when sharing sensitive information online. Tools such as Google Docs, Slack, and Notion can easily expose private data if permissions are not set correctly.