Last reviewed 31 October 2026
The setting nobody remembers changing
Every cloud service has a sharing option that sounds harmless: anyone with the link can view. You used it to send photos to family, a document to a client, a spreadsheet to a contractor. The link worked, everyone was happy, and nobody ever turned it off.
Here is the mental shift this step requires: a link is not a delivery, it's a publication with a long address. It can be forwarded without your knowledge, it lives in old emails and texts, it survives in other people's downloads folders — and it keeps working until you revoke it, which for most files is never. Treat anything link-shared as already found. Not because thieves are magically discovering your links, but because you cannot name everyone who has them, and neither can the people you sent them to.
In one real run of this step, the inventory found more than 8,000 files carrying a public link — years of accumulated sharing from a photo-delivery workflow. Almost all of it was harmless client work. Mixed into it were the files that matter: identity documents, financial paperwork, family photos of children. Nobody chose to expose those. They were exposed by default, one forgotten link at a time.
Where links hide
Check every place you store or build things, not just the obvious one:
- Google Drive / Docs / Sheets — the big one for most people
- Dropbox, OneDrive, iCloud — shared folders and “anyone” links
- Notion and similar note tools — “share to web” toggles
- Pages and documents an AI tool built for you — shared by link so you could open them; that link is still on
- Photo services — album links sent to family that never expire
The inventory comes first
Don't start clicking. Start with a list. Go service by service and write down everything that is link-shared, then sort it into three piles:
- Must stay shared — active deliveries, things a group genuinely uses right now. Keep these, but know they're public and time-limit them in your head: when the job ends, the link ends.
- Sensitive — lock now — anything with identity, money, health, legal, or children in it. ID documents, tax files, contracts, financial plans, medical paperwork, minors' photos. These go invite-only immediately.
- Everything else — the long tail of old, forgotten shares. Default answer: unshare. If nobody has asked for it in a year, nobody needs the link.
Notice what this method is not: it's not “unshare everything in one panic click.” If your work runs on shared links — galleries for clients, files for collaborators — a blanket unshare breaks your business on a Tuesday. The point is a list you decided on purpose, not a bonfire.
Three traps the inventory will find
Folder inheritance. A file inside a shared folder is shared even if you never shared the file itself. Locking a sensitive file while its parent folder stays public accomplishes nothing — check the folder, not just the file.
Files you don't own. You can only change sharing on files you own. A sensitive folder owned by someone else stays exactly as public as they left it; your only move is to ask them to restrict it (or move your material out).
The second copy. The same document often exists in three places — the working copy, the “final” copy, and the one in the folder from two years ago. Lock all of them, or you've locked a copy.
Finish with a baseline
When the lockdown is done, save a snapshot of what remains shared and why — your deliberate list. That snapshot is what makes the next step work: a monthly audit compares it against reality, and anything newly shared that isn't on your list is a flag, not a mystery. Unsharing without a baseline is a chore you'll have to redo from memory. With one, it's a ten-minute diff.
The storm connection
Your emergency documents plan — the storm guide's “medicine and documents” step — tells you to gather passports, insurance, and IDs in one place. This step is the other half of that instruction: the same documents, in the cloud, with the links turned off. Gathered and guarded. That's the whole idea of this site, applied to a folder instead of a pantry.
Sources: Google Drive Help — sharing settings and permissions (support.google.com) · Federal Trade Commission — consumer.ftc.gov