On a site, the drawings folder is the beating heart of the job. Architects, the quantity surveyor, three subcontractors and the client all need the latest revision, and the quickest way to give it to them is a shared link. Somebody, once, ticked “anyone with the link can view” because it stopped the phone ringing about access. That tick usually never gets untucked.

The problem is that a link like that is not a door with a lock. It is an address, and addresses travel. It gets forwarded in an email chain, pasted into a WhatsApp group, saved in a supplier's own system and quoted in a tender. Once it is loose, anyone who has ever seen it can open the folder, and so can anyone they passed it to, from anywhere, for as long as the link exists.

When we checked one client's folder recently, the access log showed opens from four countries and dozens of views the firm could not account for. Nothing dramatic had happened yet, but the drawings, the client's address, the programme and the pricing were all sitting there for the taking. For a competitor bidding the same work, or someone casing a high-value site, that is a gift.

The fix is not to stop sharing, because you cannot run a site that way. It is to share to named people instead of to a link, so access is a list you can see and prune when a subcontractor leaves the job. Set links to expire, review who has access at each stage, and keep the truly sensitive drawings in a folder that is shared deliberately and narrowly rather than by default.