I reported it to Google & Google confirmed that this is working as intended - not a #vulnerability

🚨 Hidden tabs in #google Sheets are NOT a security feature.

In this video, I demonstrate how a user with View-only access can still access the contents of hidden sheets using Google Apps Script.

I responsibly reported this behavior to Google VRP, and Google confirmed that this is working as intended — not a security vulnerability.

📌 Key takeaway:
Hiding a sheet only hides it from the UI. It does NOT protect the underlying data.

Many users assume hidden tabs are secure for:
• Internal notes
• Student answers
• Form-linked data
• Sensitive references
• Admin-only information

But if someone already has access to the spreadsheet, hidden content may still be accessible.

⚠️ This video is shared for educational and security awareness purposes only.

✅ Google’s response:
Google clarified that hidden sheets are not considered a security boundary, and users with access can already reveal hidden sheets in other ways (such as making a copy of the spreadsheet).

🎯 Lesson:
UI restrictions should never be treated as real access control.

#GoogleSheets #CyberSecurity #GoogleWorkspace #InfoSec #BugBounty #SecurityAwareness #AppsScript #EthicalHacking #DataSecurity #GoogleVRP #vulnerability #proofofconcept

google sheets
google apps script
google sheets security
cyber security
bug bounty
ethical hacking
google vrp
information security
hidden sheet
apps script poc
google workspace security
security awareness

Видео I reported it to Google & Google confirmed that this is working as intended - not a #vulnerability канала CYB3R0X01