You probably have a Google Drive folder you shared at some point — maybe with a client, a contractor, or a former team member. It felt safe at the time: you sent a link, they accessed the files, life moved on. But that link, and the permissions behind it, may still be active. Worse, Google Drive’s permission model means one broad setting at the top of a folder can silently expose everything nested inside — including files you added after the share was created.
Data Privacy
Remote Work Security
Google Drive
Shared Folders
The Folder You Shared Last Year Is Still Open
Say you shared a folder with a client back in March. You added new project files later — spreadsheets, a PDF with client contact details, a rough budget draft. Unless you manually adjusted permissions on each new file, they all inherited the same access level you set on the parent folder. That’s how Google Drive’s inheritance works: a single permissive ACL at the top cascades down to every subfolder and file, even ones created months after the original share.
And those open links don’t expire. The same report notes that 94% of open link shares are inactive — nobody is using them, but the data is still reachable. A real example: Japanese developer Ateam exposed personal data of nearly 1 million people for over six years because a Google Drive folder was set to “Anyone with the link,” according to the company’s own disclosure. Names, email addresses, phone numbers — all accessible to anyone on the internet who happened across the URL.
It’s unsettling to realize a file you created years ago could still be accessible to someone you no longer work with. But that’s the reality of inherited permissions and orphaned ACLs — entries that persist even after a file is moved or the original collaborator is offboarded. Most of the technical detail on how Google Drive handles permissions comes from a thorough Medium article by Kayvan Shah, which maps out the data model, ACL inheritance, and the ways shortcuts can bypass expected boundaries.
When Shortcuts Bypass Your Permissions
Google Drive shortcuts (metadata-only items pointing to a file or folder) don’t change the original file’s permissions. But they can be shared independently. If you create a shortcut to a sensitive document and share that shortcut with an external user, that person gains access to the original file — even if the original was never explicitly shared. The shortcut acts as a pass-through, and because it’s a separate item, it won’t show up in the original file’s sharing history. This makes auditing tricky: a file might be exposed through a shortcut you forgot you created.
This isn’t just theoretical. The Medium article I mentioned earlier highlights shortcut confusion as a known risk vector in Google Drive’s data model. The stable file IDs also work against you: once a file ID is leaked, an attacker can repeatedly test access over time, even if the file is renamed or moved.
The Desktop App Flaw on Shared Computers
If you use the Google Drive desktop app on a shared or family computer, there’s a specific vulnerability you should know about. Researchers disclosed CVE-2025-5150, a flaw in the Drive desktop app for Windows that allows any logged-in user on a shared device to access another person’s cached data without re-entering credentials. According to reporting by Petri, the app stores user data in a folder called DriveFS that isn’t securely isolated per user. Someone with local access can copy that cache folder into their own profile, and when the app restarts, it trusts the cached content and mounts the other person’s drive without authentication.
- Avoid installing the Google Drive desktop app on machines where multiple people log in. Use the browser version instead on shared devices.
- If the desktop app must be used, enforce regular clearing of cached data — especially before handing the device to another user.
- IT admins can restrict installation and use of the Drive desktop app via endpoint management tools. For remote workers, this means treating your work laptop as a dedicated device, not a family computer.
The Third-Party Apps You Approved Without Thinking
Every time you connect a PDF converter, a backup tool, or a document editor to Google Drive, you’re granting that app OAuth scopes — permissions to read, write, or even delete files. Many apps request broad scopes like “drive” (full access) when they only need “drive.file” (access to files the app creates). The consent screen flashes by, you click Allow, and the app gets a refresh token that can be used indefinitely.
If that app’s backend is compromised, the attacker gains API access to your Drive without needing your password or multi-factor authentication. The threat isn’t hypothetical: security researchers have documented OAuth token theft in cloud environments, and the Cloud Security Alliance flags shadow IT — unvetted app installations — as a leading risk. Even if your Drive is perfectly locked down, a connected app with broad scopes can become an exfiltration channel.
Scope drift is another concern. An app initially requests minimal access, then later prompts you for more permissions. You might not notice the change in the consent dialog. Over time, a single “helpful” tool can accumulate access to far more data than it needs. The best practice is to regularly review connected apps at your Google Account Security page and revoke tokens for anything you no longer use or trust.
Practical Steps to Lock Down Shared Folders
You don’t need to become a security administrator to get a handle on this. A few straightforward changes can dramatically reduce exposure without breaking your workflow.
- Turn off “Anyone with the link” sharing at the domain level if you’re an admin, or avoid using it entirely for your personal Drive. Prefer sharing with specific email addresses.
- Set the default Access Checker to “Recipients only” — it’s a behavioral nudge that starts from the most restrictive option. Most users accept the default, so make it a safe one.
- Disable “Publish to the web” for files unless you explicitly need a publicly indexable page. Published documents auto-update with changes and can be discovered by search engines.
- Review your Shared Drives (team drives) — restrict creation to admins, disallow member overrides of sharing settings, and audit external members quarterly.
- If you have a Google Workspace Enterprise account, set up DLP rules to scan for sensitive data like credit card numbers or Social Security numbers. Start in audit-only mode to see what’s out there before blocking.
For a deeper dive into broader data privacy practices, I’ve written about keeping data private while working remotely and put together a data privacy checklist that covers password management and access controls.
The folder you shared last year doesn’t have to be a liability. A few minutes of cleanup now can save you from a much messier conversation later. And if you’re not sure where to start, treat your Drive like your home: check who has keys, revoke the ones you don’t remember giving out, and lock the door behind you.