The Register reported on August 13, 2026 that a contractor placed staging environment credentials in a Google Doc that was set to public link access. The problem came to light when an employee typed the company's domain into Google Search and saw a hostname and credential string appear through autocomplete.
The company described the exposed credentials as belonging to a staging environment, not its production systems. That distinction matters, but it does not make the issue harmless. Staging systems often connect to code, test data, integrations, vendor tools, and administrative workflows. They can also teach an attacker how the real environment is built.
The useful lesson is simple: shared documents are collaboration tools, not password vaults. Google Docs, Slack, Notion, email, project boards, and ticket comments can all feel private when a team is moving quickly. A public link, a forgotten contractor account, or a copied credential can turn that convenience into a business risk.
The business risk is ownership
This is not only a Google Workspace story. It is a contractor access review story, and it applies to Microsoft 365, Dropbox, Box, Notion, Slack, Teams, password managers, website admin portals, QR-code platforms, CRMs, and line-of-business applications.
Business owners do not need to personally inspect every shared document. They do need to know who owns the rules. If a web developer, marketing vendor, MSP, employee, or temporary contractor needs access to a system, there should be an approved place to store the credential, a named owner for that access, and a clear offboarding step when the work ends.
Google's own Workspace guidance gives administrators options for external sharing, public link sharing, warnings, allowlisted domains, and Drive data loss prevention rules. Those controls are useful only when someone decides how collaboration should work for the business, instead of letting every user improvise.
Questions to ask your IT provider or internal team
- Where are passwords allowed to live? Ask whether employees and contractors are required to use a managed password manager instead of Google Docs, spreadsheets, Slack messages, email, or project notes.
- How do we find public Google Doc password exposure? Ask whether the team can review files shared with anyone who has the link, especially documents containing hostnames, API keys, admin URLs, customer data, or credentials.
- Who controls Google Drive sharing controls? Confirm whether external sharing, public links, warnings, allowlisted domains, and Drive DLP rules are configured for the way your organization actually works.
- What changes when a contractor leaves? Contractor offboarding should revoke accounts, rotate shared credentials, remove document access, check delegated admin rights, and confirm ownership of any systems the contractor touched.
- Which staging systems still matter? Staging, demo, test, and marketing systems should not be treated as disposable if they connect to real domains, code repositories, customer workflows, payment tools, or vendor accounts.
A practical next step
Start with a small shared-document security review. Ask for a list of files and folders shared publicly or externally, then sample the riskiest ones for passwords, access tokens, QR-code destinations, vendor credentials, and administrative notes. The goal is not to slow normal collaboration. The goal is to remove secrets from places that were never built to protect them.
For many New Jersey businesses, this review will be more useful than another awareness poster about strong passwords. The immediate decision is concrete: approve a password manager for employees and contractors, define who can share documents outside the company, and require credential rotation when access leaves your direct control.
A password in a public document is not a sophisticated failure. That is exactly why it is worth fixing. The everyday mistakes are the ones most likely to fit into a busy office workflow unnoticed.
Sources and further reading
