Breaking Lab srl
The setting that feels safe but isn’t
When you share a Google Doc using the “anyone with the link” option, it feels private enough. After all, you haven’t emailed the link to strangers — you’ve just made it accessible to whoever has it. The problem is that Google can index those documents, meaning its search engine crawls them and adds them to public search results. If someone links to your document from a website, a forum, or even a chat tool that gets crawled, the contents can show up in a Google search for anyone to find.
That is exactly what happened to one developer, who shared a Google Doc containing company passwords using this setting. The document eventually surfaced in Google Search results — visible to the entire internet.
Why this catches people out
The confusion comes from a reasonable but wrong assumption: that a link-based share is like a locked door where only people you hand the key to can enter. In practice, it’s more like leaving a document on a park bench. Nobody is stopping a stranger from picking it up if they happen to walk past — and Google’s web crawlers walk past a lot of places.
Google itself says it may index “anyone with the link” documents if it discovers them through other web pages. The more a link gets shared — in a public Slack workspace, a GitHub readme, a shared team wiki — the higher the chance a crawler finds it.
What you should do instead
If a document contains anything sensitive — passwords, API keys (codes that let software connect to services), customer data, internal plans — use “Restricted” sharing in Google Docs. This limits access to specific named Google accounts and prevents the document from being indexed. Never use a shared document as a password store at all; use a dedicated password manager such as Bitwarden or 1Password, which encrypt data properly.
It is also worth doing a quick audit of documents you have shared in the past. Open Google Drive, filter by “Shared with anyone”, and review what is there. Sensitive files should be switched to Restricted immediately.
The bigger lesson
Convenience settings in cloud tools are designed for sharing work quickly, not for protecting sensitive information. The gap between “I shared a link” and “this is publicly searchable” is smaller than most people realise. As teams increasingly live inside Google Workspace and similar platforms, it only takes one misconfigured document to expose data that should never have left the building. Treating every cloud share as potentially public — until you have actively restricted it — is the safest default mindset to have.
