Expiring links, and why leaked share links kept working

A link turned up in a malware log. Opened in a browser, with no login and no password, it showed a folder of a large company's security-monitoring material: detection rules, search queries, logging settings and sample logs.

Nobody had broken in. The link had simply never stopped working.

That is the opening case in LinkDrift, research the security firm Claroc published on 5 October 2026. It's worth reading in full, because it describes the most ordinary exposure there is: a share link sent once, for a good reason, and then forgotten.

Why an expiring link matters once the URL has leaked

Claroc started with links that had already escaped, then worked back to the 326 organisations that owned them. Among the Fortune 500 companies in it, about 800 links opened without an account, and most of those didn't ask for a password either.

Most of that material was meant to be public: conference presentations, published reports, marketing content. But at 19 Fortune 500 companies the links opened sensitive or internal files, including operational runbooks, financial models, personal data and documents meant only for business partners.

One folder alone reported 749.1 GB across 8,496 files.

The sentence we keep coming back to is a short one. The platform supported expiry, but these links had not expired when Claroc tested them.

So the control existed. It just wasn't switched on.

Claroc is clear that these cases came from how companies used and configured a file-sharing platform, not from a flaw in the platform, and it doesn't name the companies or the platform. Neither will we.

An expiring link doesn't stop a URL from leaking. It decides how long a leaked URL is worth anything.

How share links travel after you send them

You send a link to one person. Claroc found share URLs in three kinds of places that person never meant to put them.

• Infostealer logs, where malware on an infected computer collects browser data, share links included, and the logs are later sold or indexed.
• Public URL scanners, where someone pastes a link to check it's safe and the submission becomes searchable by others.
• Code repositories, public tickets, forums and web archives, where links sit long after the work is done.

None of this needs anyone to be reckless. A contractor's laptop picks up malware next spring. A colleague checks a suspicious-looking link on a public scanner. The link you sent in March is now in a list somebody else can search.

Passwords didn't always help either.

Some of the shares Claroc found were password protected, but the password had leaked alongside the URL. A password is still a good second lock, and we've written about adding one. It just tends to travel in the same email, chat and browser as the link.

When the address itself gives the link away

A second story this week shows a different route. Meta's Muse app, launched on 8 September, let people share a conversation by link, and the shared page opened for anyone who had the link, without a login.

Claroc found that Muse built each share's web address from the conversation's own title plus a random ID, in the part of the address that gets looked up in DNS.

When a recipient opened a share, that lookup could be recorded by passive-DNS services, which keep searchable histories of domain names. One search returned more than 6,800 share addresses, listed by title. Ars Technica reported the findings on 20 October.

Meta told Ars it had "paused this functionality while we review this report and consider changes to how these links can be discovered."

When Claroc rechecked 40 shares on 20 October that had opened earlier in the month, none of them opened, and Claroc said it was glad to see the feature closed so quickly. The addresses themselves are still in passive-DNS history.

Two lessons carry over to anyone who sends files. The random part of a link only protects you while the link stays private, and you don't control every system it passes through.

The other lesson is the fix that worked: once the pages stopped serving, the addresses still in circulation stopped opening.

How to make a link inactive after you've sent it

Claroc's own advice is practical, and most of it applies to a five-person studio as much as to a Fortune 500 security team. Here's our version for the links you've already sent.

1. List what's shared publicly. Most file-sharing tools can show you links set to "anyone with the link". Start with folders, because one folder link can open everything nested inside it.
2. Switch off links from finished work. If a project, deal or matter has closed, its links should close too. Restrict them to named people or remove access.
3. Put an end date on the links you keep. If a public link is genuinely needed, give it an expiry date.
4. Check upload links. Claroc found file-upload forms open without an account at more than one company. A drop still taking files after the job ends is another open door.
5. Don't rely on asking people to delete it. In Claroc's words, asking recipients to delete their copies does not close an active share.

Start with the oldest links. They're rarely the ones anybody remembers sending.

Do Google Drive and SharePoint links expire on their own?

Only if someone sets them up to. In Google Drive you can add an expiry date for a named person on eligible work or school accounts, but "anyone with the link" has no expiry step. We went through that gap in Google Drive will expire a named share. "Anyone with the link" will not.

In SharePoint and OneDrive, an administrator can require all "Anyone" links to expire within a set number of days. It's a good setting. It's also a setting, which means it only helps if somebody has turned it on.

The wider version of this problem, and why so many cloud links stay live for years, is in Your share link from 2021 still works. That's the problem.

How to create an expiring link in TinyX

This is the short bit about our own product.

In TinyX, a file link can carry an expiry date, a download limit, or both. When the limit is reached, the file is deleted rather than archived. You can add a password too, and expiry and passwords are both on the Free plan. Short links can end on a date or after a set number of clicks, and you can kill one yourself whenever you want.

While a link is live, you can see who opened it, from where and on what device. The full list is on features.

What we won't claim: an expiring link can't stop a URL being copied, scanned or logged on someone else's computer. It makes sure that copy stops working on the date you chose.

What a "link expired" message means

If you're on the receiving end, a "link expired" message is the system doing its job. The sender picked an end date or a download limit, and it has passed. Ask them for a new link.

On TinyX, an expired link doesn't redirect anywhere. The destination stops resolving for new visitors, and for a file link the file behind it has been deleted, so there's nothing left to open.

Expiring link questions, answered

Can you reactivate an expired link?

It depends on the service. On TinyX, the file behind an expired file link has already been deleted, so the sender uploads it again and sends a new link. An expired short link can be recreated if the work continues.

Why is the link expired?

The person who sent it set an end date or a download or click limit, or switched the link off. Ask them for a fresh one.

Does a short URL expire?

Only if the service lets you set an end and you use it. TinyX short links can expire on a date or after a number of clicks.

Is a password enough without an expiry date?

It helps, but LinkDrift found shares where the password had leaked along with the URL. Use both, and keep the window short.

Did the LinkDrift research name the companies?

No. Claroc withheld company names, filenames and URLs, and says it shared those details privately with the organisations affected.

Where to start this week

Pull a list of your public share links, close the ones from finished work and give the rest an end date. Then set the expiry on the next file before you copy the link. You can see what each plan includes on pricing.