Google Doc Credentials Leak Serves as a Cautionary Tale

A developer's well-intentioned attempt to keep credentials handy for a project spiraled into a security incident when those credentials ended up indexed by Google Search. The incident, reported by Pageloot co-founder Siim Kostabi, underscores the dangers of using collaboration tools as password vaults.

The Developer's Convenient Solution

According to Kostabi, a contractor hired to assist with API integrations needed access to staging environment credentials across various devices. Instead of opting for a password manager or a more secure method, the developer chose to store the usernames and passwords in a Google Doc. The doc was configured to be viewable by anyone with the link, and subsequently, it was indexed by Google Search.

This decision, while seemingly convenient, exposed the company's staging credentials to anyone who could find the document. Staging environments, while not production, often contain sensitive data and can serve as a stepping stone for attackers.

Discovery Through Autocomplete

The breach was discovered by accident when an employee at Pageloot was debugging an unrelated issue and typed the company's domain into Google Search. The autocomplete feature suggested one of their staging hostnames followed by what appeared to be a credential string. Investigation revealed the publicly accessible Docs URL.

A developer on our team was debugging something unrelated and typed our domain into Google Search. The autocomplete surfaced one of our staging hostnames followed by what looked like a credential string. We checked, and there was a publicly accessible Docs URL.

— Siim Kostabi, co-founder of Pageloot

This incident highlights how easily sensitive information can be exposed when not properly secured.

Immediate Response and New Rules

Upon discovery, Pageloot immediately revoked the contractor's access and rotated all exposed credentials. The company also implemented a new policy prohibiting the storage of passwords on Google Docs, Slack, Notion, or other collaboration tools.

These steps were crucial in mitigating potential damage, but they also serve as a reminder that prevention is better than cure.

A Second Incident: QR Code Hijacking

In a separate incident, Kostabi learned of a Pageloot customer, a mid-size retailer, whose QR codes were suddenly redirecting users to a competitor's site. Investigation revealed that a disgruntled ex-employee's credentials had not been revoked, allowing them to redirect all of the retailer's URLs.

This case illustrates the importance of promptly revoking access for former employees. The failure to do so had direct business consequences, as the redirects sent potential customers to a competitor.

Key Takeaways for Businesses

These incidents emphasize the need for robust access control measures. Kostabi noted that both situations were completely avoidable with basic hygiene, including proper offboarding, access reviews, and refraining from treating shared docs like private vaults.

Businesses should consider implementing regular access reviews, especially for contractors and former employees, and ensure that sensitive information is stored in secure, dedicated systems.

The Importance of Access Hygiene

Kostabi's advice is clear: carefully control access, promptly revoke credentials for former employees, and only work with contractors you can trust. These basic hygiene practices can prevent significant security incidents.

While these events are specific to Pageloot and its customer, they serve as a broader warning for organizations of all sizes.

What This Means for Your Organization

For readers, this story is a reminder that credential management is a critical aspect of security. Storing passwords in shared documents or collaboration tools, even for staging environments, can lead to exposure through indexing or other means. Implementing a password manager and enforcing strict access controls are essential steps to protect your organization.

Moreover, regularly reviewing and revoking access for former employees and contractors can prevent unauthorized use of your systems and data.