What stopped me this week wasn't a new feature—it was two files
Last Friday night, I was updating a quote for a client in Hangzhou and tossed a spreadsheet containing phone numbers into a chat app. The other person stopped me: “Don’t send this—it also has your configuration records.” I opened the folder and found a client list mixed with a string that could log into the admin panel. I used to think, “As long as I can see it, it’s fine.” Now I realize the thing a small team is most likely to overlook isn’t clients refusing to buy. It’s a file being sent to the wrong person, stored in the wrong place, or exposed alongside the tool that holds it.
The morning brief’s two stories are two warning lights
The first: China released a national standard for the cybersecurity of satellite navigation ground stations. Even infrastructure is beginning to spell out security requirements more precisely. The second: Claude Code configuration files were reportedly found to expose credentials. Put simply, if a configuration file contains a login “key,” anyone who gets the file may be able to act using your identity. We may never touch satellite equipment, but if we consult, take projects, or run communities, we handle customer data, admin access, and automated files every day.
I got stuck here too. I used to assume “putting files in cloud storage” meant they were secure. Later, I found the real problems often came in three steps: file naming, sharing permissions, and configuration files mixed in with everything else. So the first step isn’t buying a security product. It’s asking: Where are my clients’ contact details? Where are the payment details? Are any backend login credentials stored alongside ordinary documents? I messed this up as well—I put “easy for me” ahead of “easy for someone else to delete.” That order needs reversing.
Today’s replication cost: $0, 30 minutes, low technical barrier
Money: $0; no software purchase required. Time: about 30 minutes. Technical barrier: enough to drag files and click the share button. First step: open the cloud drive or project folder you use most, create a folder called “Client Files,” move scattered spreadsheets and images into it, then check each sharing permission. Next, find one configuration file containing login information and move it somewhere stored separately and excluded from routine sharing. Finally, ask a colleague: “Which client files can you see?” If they can’t answer clearly, the cleanup isn’t finished.
If I have only one client and everything lives on one computer, I’d still run this check, but I wouldn’t rush to add complex tools. With one or two clients and regular remote delivery, I’d spend 30 minutes each week clearing out old sharing links and keep separate folders for different clients. If I’m scaling and the team now has more than one person, I’d write a simple checklist covering permission reviews, file archiving, and new hires’ access, then follow it during handoffs. This isn’t about pursuing “absolute security.” It’s about reducing the mistakes most likely to happen: accidental sending and mixed storage. There’s no rush either. But the first time I can’t find a client’s file tonight, I’ll come back and spend those 30 minutes.