How One Shared Sheet Link Leaks Company Data
How one shared Google Sheet link can leak company data through permissions, copies, and forgotten access.
7 posts
How one shared Google Sheet link can leak company data through permissions, copies, and forgotten access.
Why spreadsheet inventory numbers drift, from missing stock logs to concurrent edits, cancellations, and returns.
The permission, approval-history, and audit-log risks that appear when a spreadsheet becomes an approval workflow.
Google Sheets silently coerces strings like '2026-06' into a Date. When save, read, and compare each compute the month differently, completion is rejected forever. What gets coerced, how to pin cells to text and guard on read, plus batch writes and formula injection.
The places I actually got stuck building the CheckReport Demo, with the code. Concurrent saves to a shared sheet are blocked with ScriptLock + an idempotency key, cells hold only metadata, and exports are cut off with a time budget. Good code and bad code, side by side.
In GAS the slow part isn't JavaScript, it's service calls to Sheets and Drive. Swap in-loop getValue/setValue for batched getValues/setValues and it's tens of times faster.
A Google Sheets cell caps at 50,000 characters. Put a photo or signature in a record row as a data URL and the save breaks. Keep only metadata in the cell.