Fifteen Minutes to Find Every Risky Link You've Ever Shared

Nobody sets out to leave a client contract folder open to anyone with the link for three years. It just happens. Someone shares a link in a hurry, the project ends, the link survives, and the folder quietly becomes public infrastructure.

This is not a scare piece. Most of what you'll find in this audit is harmless. But a small number of items will make you sit up straighter, and those are worth fifteen minutes of your quarter.

Here's the routine. Set a timer.

Minutes 0–3: Build the Inventory

Open your cloud storage account and pull up everything that's currently shared externally. Every major platform has this view — usually under something like Shared, Manage access, or Links.

Don't clean anything yet. Just look. Note the count.

The goal of this step is to answer one question honestly: how many things have I made available outside my organization, and do I know what they are? If the number surprises you, that's the finding. Everything after this is cleanup.

Minutes 3–6: Kill the Zombie Links

Scan the list for links whose names ring no bell at all. Folders from a project that wrapped two years ago. Vendor packets. Something labeled temp that isn't temp anymore.

For each one, ask a single question: would I be comfortable if this appeared in a search result tomorrow?

If not, revoke the link. Not delete the folder — just remove public access. If someone genuinely still needs it, they'll tell you within a day, and you can re-share with a proper expiry.

Common finds in this window:

• Old resumes and HR documents
• Pricing sheets from previous rate cards
• Event photos with faces of people who've since left
• A folder literally named share with 40 files in it

Minutes 6–9: Fix the Permissions You Kept

Now go through the links you're keeping and check the role attached to each one.

Viewer beats editor almost every time. A vendor needs to see the brief, not restructure it. A client needs the deliverable, not the working file. Editor access on a public link is how a folder gains a Copy of Copy of subfolder at 2 a.m.

Check whether "anyone with the link" is doing work that "specific people" should be doing. If you can name the three people who need it, list them by email instead.

Look for download permissions. Many platforms let you allow viewing but block downloading and printing. For anything sensitive — financials, ID documents, legal drafts — turning that off is a five-second change that changes the whole risk profile.

Add a password to anything going outside your organization that contains personal or financial data. It's not perfect protection, but it stops the link that gets forwarded one hop too far.

Minutes 9–12: Turn On the Guardrails You've Been Ignoring

Most paid plans ship with defaults that are more open than they need to be. Check these settings once and you'll never think about them again:

• Default link expiration. Set it to 30 or 90 days depending on your work. Anyone who needs longer can get a new link.
• Default role for new shares. Set it to viewer.
• Password default. On, if available.
• External share notifications. Turn on alerts so you know when someone outside your domain accesses a file.
• Download restrictions for shared drives. Especially relevant if you work with regulated client data.

One note: don't turn on every control at once. Teams that bolt down everything overnight end up bypassing their own system with personal accounts, which is worse. Pick the two defaults that matter and let the rest be.

Minutes 12–15: The Offboarding Check

This is the one people skip, and it's the one that causes real problems.

When someone leaves — employee, contractor, agency partner — their shared folders usually stay exactly as they were. Their links remain live. Their access remains granted. Their name remains in a permission list nobody reads.

So do this now, while the timer runs:

1. Open the member or people list for your main shared drives.
2. Find anyone who shouldn't be there anymore.
3. Remove them.
4. Transfer ownership of any files they owned — because on many platforms, removing a person can orphan or delete their content.
5. Check for links they created that are still live.

Then put a repeating 15-minute block on your calendar for the same time next quarter. This is not a one-time fix. It's a habit.

What Good Looks Like Afterward

You won't end up with zero shared links. You'll end up with a short list you can actually describe out loud — a handful of active folders with sensible expiry dates, viewer-level access, and names you recognize.

That's the whole goal. Not airtight security theater, just the absence of surprises. Most small US teams don't have a dedicated IT person, and they don't need one for this. They need a timer, a list, and the willingness to click revoke on something they forgot they made.

Fifteen minutes, once a quarter. It's the cheapest insurance in your stack.