I Audited the Company Shared Drive. The 2019 Password Sheet Still Worked.

A five-minute favor became an afternoon: Passwords-2019.xlsx with live credentials, a 43-editor customer CSV, a link-shared terminal screenshot, a DB dump in tmp-exports. The sweep queries, the Apps Script sharing audit, the purge day, and the swamp-drainage pattern.

It started as a five-minute favor: a new hire asked where "the customer list" lives, and I said "oh, somewhere in the Drive," because that's what everyone says. The five minutes became an afternoon.

Hit one: Passwords-2019.xlsx — half of them still worked, including one for a service we still pay for. Hit two: a folder with forty-three editors holding a customer export CSV from "that one campaign" in 2022. Hit three: an onboarding doc shared with anyone with the link since creation, containing a terminal screenshot. With an API key. In the screenshot. Hit four: a database dump in tmp-exports, because of course. Hit five: scanned contractor contracts — signatures, home addresses, ID numbers — in searchable PDFs.

We run access reviews. We tier production. We argue about intern scopes. And the broadest, least-reviewed datastore in the company had a friendly icon and infinite storage.

The Drive is where data goes to escape controls
The shared Drive isn't a filing cabinet; it's a shadow production database — where copies go to live outside every control we built:

Exports are production data minus production controls. The moment a query becomes a sheet, access logging, row permissions, retention, and deletion paths stay behind. The vault's rules don't follow data out the door.
"Anyone with the link" is standing access with no roster. A permission you can't enumerate, living in chats, emails, and the bookmarks of people who left.
Version history is a time machine for secrets. Clear the password from the sheet and it's still in v3, v7, and the "cleaned" copy someone made. In Drive, deletion is a view, not an event.
Orphaned folders outlive their owners. Creator left in 2023; the folder kept its sharing, its editors, its exports. Nobody owns it, so everybody can read it and nobody can answer for it.

The sweep
Search operators first — run these and write down the counts:

fullText contains 'password'
fullText contains 'api key'
name contains 'export'
name contains 'customer'
name contains 'final'

Then the sharing audit, as Apps Script (paste into script.google.com, run, weep):

// every file reachable by "anyone with the link"
const it = DriveApp.searchFiles('visibility = "anyoneWithLink"');
while (it.hasNext()) {
  const f = it.next();
  Logger.log(`${f.getLastUpdated().toISOString().slice(0,10)}\t${f.getName()}\t${f.getUrl()}`);
}
// and the orphan check: files whose owner is inactive
// (cross-reference owners against your HR roster; the delta is your sediment)

The counts are your real access review. Ours were three digits, and the anyoneWithLink list included the terminal screenshot.

What changed

• Export amnesty, then a purge day. One month to declare exports, no blame; after the deadline, the sweep deletes what nobody claimed. Amnesty first — fear is what created the hidden copies.
• Link-sharing off by default; external shares get expirations. Sharing still exists; now it has a roster and a sunset (Drive permissions support expirationTime — use it).
• Customer data lives in systems with access models. The Drive holds references, not rows: dashboard links, ticket numbers, query names.
• Data work happens where the data lives. The habit that made the rest stick: analysts spin an ephemeral Cube on Krova Cloud, seeded with a scrubbed dataset at boot, analyze inside it, delete it after:

CUBE="analysis-$(date +%F)"
krova cubes create "$CUBE" --cpu 2 --ram 4 --disk 40 --image ubuntu-24.04 \
  --user-data "$(cat seed-scrubbed.yml)"     # scrubbed dump in, live rows never out
# ... analysis happens inside ...
krova cubes delete "$CUBE"                   # the sheet that lives forever never gets created

The safe path became the fast path, and the swamp stopped rising.

• Every shared folder gets an owner; offboarding transfers ownership. Orphaned folders are how sharing outlives employment.
• The password sheet died properly. Not cleared — deleted, revisions and all, after the last live credential moved to the password manager. Cleaning a Drive file leaves the mess in its past; only the funeral works.

The honest part
The Drive is the company's memory. Don't burn it. The swamp water is bad; the land is fertile. The goal is a Drive that holds thinking instead of data.
Some exports are load-bearing. Finance's monthly sheet is a business process wearing a CSV — migrate it to a scheduled pipeline with an access model, don't just delete it.
Perfection is impossible; tiering is not. Contracts get the strictest shelf; brainstorm docs get freedom. Uniform strictness just teaches people to work around it.

Your Drive is a database without a bouncer
No uptime SLA, no access log, no owner — just a search box, infinite storage, and everyone's best intentions since 2019. Go type password into it. Then export. Then customer. Then final. Count what comes back; that number has been waiting since the day someone clicked "share."

Confession booth: what did your Drive search surface — the living password sheet, the link-shared terminal screenshot, final_final_v2? Ours had all three plus a scanned-ID folder I still think about. Comments open; the swamp is listening.

I'm Dhruv Malaviya (dhruonweb) , CEO of Krova Cloud, Shoptimity & DraftRank: snapshots roll a disk back in minutes and Backups outlive the Cube they came from, so recovery is a verb you can schedule. A restore you've never rehearsed is folklore: the platform supplies the undo, you supply the drill.