💡 New script: drive-sharing-audit (personal Drive permissions visibility report)

[github-actions[bot]]

Summary

A read-only Google Apps Script that scans user-specified Drive folders on a monthly schedule and generates a Sheets report of all files with external sharing: file name, sharing type (anyone with link, specific external users, domain-wide), shared-with email addresses, last modified date, and folder path. Helps individuals and small teams maintain visibility over who can access their files — a personal data governance tool with zero risk (never modifies sharing settings).

Market Signal

Data governance and permission visibility are top Workspace concerns for 2026 per CloudM's annual trends report — "data is created faster than teams can classify or secure it, and manual governance is no longer viable." Enterprise tools (BetterCloud at $3/user/month, GAT+ at $3.50/user/month) serve this need for organizations, but no personal-use, free, open-source tool exists. Google Drive's native sharing UI shows permissions per-file only — there is no overview or report capability. With Google Workspace plans now including Gemini and more collaboration features, file sharing has accelerated beyond users' ability to track it manually. Apps Script's promotion to a Core Service (June 2026) with enterprise-grade data protection makes it a credible platform for personal security tooling.

User Signal

Discussion #472 (drive-cleanup-auditor) addresses storage concerns; this complements it by addressing access/security concerns — the other half of Drive hygiene. The two scripts together provide comprehensive Drive health: what's taking up space (cleanup auditor) and who can see your files (sharing audit). Community forums frequently feature "how do I see all files I've shared externally?" questions with no good answer besides third-party enterprise tools or manual folder-by-folder inspection.

Technical Opportunity

DriveApp.getFolders() and DriveApp.getFiles() support iterating Drive contents. File.getSharingAccess() and File.getEditors()/File.getViewers() expose sharing details. SpreadsheetApp writes the report. The read-only constraint (never calls setSharing(), removeEditor(), etc.) makes this inherently safe — a key selling point for security-conscious users. Continuation tokens via PropertiesService handle large Drives across multiple execution runs — the same batching pattern proven in gmail-to-drive-by-labels for processing large thread backlogs.

The deploy page's existing Drive Picker provides the folder-selection UX for scoping which folders to audit. The SCRIPT_CATALOG config schema supports Drive folder pickers natively.

Assessment

Dimension	Score	Rationale
Feasibility	med	DriveApp iteration is well-supported but large Drives require batching with continuation tokens. The read-only constraint simplifies implementation (no write-side edge cases).
Impact	med	Serves a real but niche need — security-conscious individuals and small teams. Complements the existing drive-cleanup-auditor idea for comprehensive Drive hygiene.
Urgency	med	Data governance concerns are growing steadily as AI-accelerated collaboration increases file sharing volume, but there's no specific triggering market event.

Adversarial Review

Strongest objection: DriveApp iteration on large Drives (10,000+ files) will hit the 6-minute execution time limit. The script may never complete a full scan.

Rebuttal: Mitigation: (1) configurable folder scope — users select specific folders to audit via the deploy page's existing Drive Picker, not entire Drive, (2) continuation token pattern (proven in gmail-to-drive-by-labels) processes files in batches across multiple trigger runs, (3) the "externally shared files only" filter dramatically reduces the working set (most users share <5% of their files externally), (4) incremental mode: after first full scan, subsequent runs only check files modified since last scan using DriveApp.searchFiles('modifiedDate > "timestamp"'). For the target persona (personal Drive, small team), this is well within limits.

Suggested Next Step

Benchmark DriveApp.getFiles() iteration speed and getSharingAccess() call cost to validate that a folder-scoped scan completes within GAS execution limits. Define the Sheets report schema (file name, path, sharing type, shared-with, last modified, size) and the continuation token batching strategy. Pair with drive-cleanup-auditor (#472) in the roadmap for a "Drive Health" script duo.