Staging server passwords exposed after contractor saved them in a public Google Doc

Pageloot engaged an outside developer to help integrate APIs and provided the individual with staging environment login details. Instead of using a password manager or other secure method, the developer saved the credentials in a Google Document that was configured to be viewable by anyone who possessed the link. The document was later indexed by Google, and an employee noticed the staging hostname and credential string appear as an autocomplete suggestion while searching the company’s domain.

Upon discovery, Pageloot cut off the contractor’s permissions, rotated all compromised credentials, and instituted a policy prohibiting the storage of passwords in Google Docs, Slack, Notion, or similar collaboration platforms. The incident underscores the importance of proper off-boarding and rigorous access-review practices.