Claude Share Links Got Indexed by Google. Now What?

By Lazar Milicevic · Published September 14, 2026 · 9 min read

Over the weekend a Reddit thread lit up: shareable Claude conversation links — the ones you generate to send a chat to a teammate or client — were showing up in Google Search results. Not private, not gated, just live URLs anyone could click. If you or your team have been sharing Claude conversations to hand off work, review outputs, or paste into Slack, some of that content may already be crawlable.

This is not a Claude-specific failure mode. The same thing has happened with ChatGPT, with Bard/Gemini transcripts, with Notion pages, with Trello boards, with Google Docs set to "anyone with the link." The pattern is always the same: a "share" feature ships, users treat it like a DM, search engines treat it like the open web, and six months later somebody's client data is a search result.

If you run a solo shop or a small team using Claude for real work — proposals, code review, customer emails, contracts — this post is the checklist. What actually leaks, how to check, how to lock it down, and how to keep using shared links without turning your client folder into a Google-indexed archive.

What actually happened with Claude share links

Claude's share feature generates a public URL for a conversation. According to the Reddit thread that surfaced this, some of those URLs ended up in Google's index and were returned as normal search results — meaning the conversations were reachable by anyone who typed the right query, not just people the sharer sent the link to. Artifacts (the code, docs, and HTML previews Claude generates alongside a chat) appear to be included when the parent conversation is shared.

The mechanics are boring and predictable. A shareable link is, by default, a page on the public web. If Google's crawler finds it — via a backlink, a paste in a public Slack, a tweet, a forum post, a scraper — it can index it. The robots.txt and noindex behavior of the share endpoint is the vendor's responsibility. If those controls are missing, weak, or misconfigured, the URLs are fair game. Anthropic has historically documented share links as "anyone with the link can view," which is exactly the same language Google Docs uses — and Google Docs pages have been indexed too when linked from public places.

The important thing for you as an operator: assume any share link you have ever created can be found. Plan from that assumption backward.

Check right now whether your shared chats are exposed

Do this before you finish reading the rest of the post. It takes about five minutes.

Run these Google queries, substituting terms that would appear in your own conversations (client names, internal project codenames, unusual phrases you know you've pasted):

site:claude.ai/share "acme corp"
site:claude.ai/share "your-project-codename"
site:claude.ai/share "confidential"
site:claude.ai/share "@yourdomain.com"

Also try broader sweeps for content types you know you've generated:

site:claude.ai/share "SOW" OR "statement of work"
site:claude.ai/share "API key" OR "sk-"
site:claude.ai/share "SELECT * FROM"

If nothing comes back, good — but Google's index is not the only crawler on the internet. Also check Bing (site:claude.ai/share ...) and, if you're paranoid enough (you should be), run the same searches on DuckDuckGo and Kagi.

For the links themselves: open Claude, go to your account settings, and pull up the list of shared conversations. Review every entry. If you cannot remember why a link exists, revoke it. This is the exact same hygiene you should already be doing on Google Drive's "Shared with link" view and on your GitHub gists.

The three-tier data classification you should already have

Most solo operators and small teams don't have a data classification policy because "policy" sounds like a thing enterprises with compliance officers do. But you're handling client data. So a lightweight version is table stakes.

Here's the version I use with clients. It fits on a Post-it.

The rule that keeps you out of trouble: the share button is a Green-tier feature. If the conversation contains anything Yellow or Red, do not generate a public share link, ever. Copy-paste into a private channel instead.

If you're wondering "how do I enforce this on myself when I'm tired at 6pm on a Friday" — you don't rely on willpower. You separate accounts. One Claude workspace for public/Green work, another for client work where sharing is disabled at the workspace level (available on Team and Enterprise plans; check Anthropic's current plan matrix).

Prompt hygiene: what to strip before pasting into any LLM

Assume every LLM conversation is one misconfiguration away from being public. That's not paranoia, that's a design constraint. Once you accept it, prompt hygiene becomes obvious.

A minimum stripping pass before pasting client data:

# The kind of pre-processing I run on anything before it hits a chat UI.
# This is illustrative — tailor patterns to your actual data.

import re

REDACTIONS = [
    (r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b", "[EMAIL]"),
    (r"\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b", "[PHONE]"),
    (r"\b\d{3}-\d{2}-\d{4}\b", "[SSN]"),
    (r"\b(?:\d[ -]*?){13,19}\b", "[CARD]"),
    (r"sk-[A-Za-z0-9]{20,}", "[API_KEY]"),
    (r"ghp_[A-Za-z0-9]{20,}", "[GH_TOKEN]"),
    (r"AKIA[0-9A-Z]{16}", "[AWS_KEY]"),
]

def scrub(text: str, client_aliases: dict[str, str]) -> str:
    for pattern, replacement in REDACTIONS:
        text = re.sub(pattern, replacement, text)
    for real_name, alias in client_aliases.items():
        text = re.sub(re.escape(real_name), alias, text, flags=re.IGNORECASE)
    return text

# Example
aliases = {"Acme Financial": "ClientA", "Jane Doe": "PersonA"}
safe_prompt = scrub(raw_prompt, aliases)

Two habits that go with this:

1. Alias your clients in prompts. "ClientA," "ProjectBlue," "the vendor" — never the real name. If the chat leaks, it leaks anonymized content.
2. Never paste raw config files. .env, credentials.json, ~/.aws/credentials, kubeconfig, database dumps. Refer to them by shape ("a Postgres connection URL," "an OpenAI API key") and let the model reason about the shape without seeing the value.

Yes, this adds friction. That's the point. Friction is what stops the 6pm-Friday paste that ends up on Google in three months.

De-indexing content that's already out there

If your searches turned up hits, act in this order.

1. Revoke the share links inside Claude first. This makes the URLs return a 404 or a "not available" page. Do this before doing anything else — you don't want Google to reconfirm a live page while you're filing removal requests.

2. Submit URL removal requests to Google. Use Google Search Console's Removals tool if you own the domain (you don't own claude.ai, so this won't apply to the share URLs themselves). For content you don't own, use Google's "Refresh Outdated Content" tool — this works for any URL and is designed for exactly this case: page is gone or changed, get the snippet out of results.

3. Do the same for Bing. Bing has its own Content Removal tool. Different index, different queue.

4. Check the Wayback Machine. web.archive.org/web/*/claude.ai/share/* — if the Internet Archive grabbed a snapshot, that's a separate delete request via their help form.

5. If credentials leaked, rotate them. Any API key, password, or token that appeared in a shared chat should be considered compromised. Rotate now. Assume someone scraped the URL between when Google indexed it and when you revoked it.

6. If client PII leaked, notify. Depending on jurisdiction (GDPR in the UK/EU, state laws in the US like CCPA, sector rules like HIPAA), you may have a legal notification obligation. Talk to counsel. This isn't optional and it isn't something to figure out on the fly during the incident.

Timeline reality: de-indexing usually takes a few days once the underlying URL returns 404 and you've filed the removal request. Screenshots and cached copies on third-party sites are harder — those may live forever.

Architecture patterns that make this class of leak impossible

The permanent fix is not "be more careful." It's designing your workflows so the risky action doesn't exist. A few patterns I set up for clients:

Pattern 1: API-only for sensitive data. Client work that touches Yellow or Red data goes through the Anthropic API, not the Claude web UI. The API doesn't have a share-link feature to accidentally use. Retention is controllable via Anthropic's zero-data-retention options for eligible customers. Wire it into a small internal tool your team uses instead of chat.

# Minimal internal endpoint — no public share surface exists
from anthropic import Anthropic

client = Anthropic()  # ANTHROPIC_API_KEY from env, never in prompt

def ask_claude(system: str, user: str) -> str:
    msg = client.messages.create(
        model="claude-sonnet-4-5",
        max_tokens=2000,
        system=system,
        messages=[{"role": "user", "content": user}],
    )
    return msg.content[0].text

Conversations live in your database, under your access controls, behind your auth. No public URL to leak.

Pattern 2: MCP with scoped data access. Model Context Protocol lets Claude reach into your systems (CRM, Google Drive, Postgres, internal APIs) through a controlled server you own. Instead of pasting a customer record into a chat, the model asks your MCP server for the record, gets exactly what the tool exposes, and works with it. Your MCP server enforces permissions.

# Sketch of an MCP server config with scoped tools
tools:
  - name: get_customer_summary
    description: Returns non-PII summary of a customer by ID
    permissions:
      - role: sales
      - role: support
    filters:
      exclude_fields: [ssn, dob, card_last4, address_full]
  - name: list_open_tickets
    description: Returns open support tickets, subject line only
    rate_limit: 100/hour

The model never sees fields you don't expose. The chat log — even if leaked — contains only summaries, not raw records.

Pattern 3: Workspace-level sharing disabled. On Anthropic's Team/Enterprise tiers, admins can disable share link generation entirely for the workspace. If your team has one Claude workspace for client work and sharing is off at the org level, the failure mode we're discussing cannot occur inside that workspace, period.

Pattern 4: Ephemeral scratch space with auto-purge. For the times you genuinely need to explore something messy, use a workspace that auto-deletes conversations after N days. Anthropic offers conversation history controls; combine with a personal habit of nuking old chats weekly.

The bigger point: LLM chats are not a document store

The reason this keeps happening — with Claude, with ChatGPT, with everyone — is that people are using chat interfaces as if they were private notebooks or shared docs. They're neither. They're a UI on top of an inference API, wrapped in features (share, artifacts, projects, memory) that carry their own attack surface.

If a conversation is worth keeping, it belongs in a real system: a doc, a ticket, a repo, a database. If it's worth sharing, share the artifact — the code, the summary, the write-up — not the raw chat. Chats are cheap; the transcript is not the deliverable.

Treat the chat UI like a whiteboard: useful for thinking, wiped before the next meeting.

How BizFlowAI approaches this

We build Claude and MCP workflows for solopreneurs and small teams where "the intern accidentally shared a client conversation" is a scenario the architecture makes impossible, not a risk we manage through training. That means API-first integrations for anything touching client data, MCP servers with per-tool permissions and field-level filtering, secrets kept in a vault the model never sees, and separate workspaces for exploratory vs. client work with share features disabled where they don't belong.

If you're using Claude for real work and you just ran the Google searches above with a knot in your stomach, book a discovery call. We'll walk through your current setup, find the exposure points, and either help you fix them or hand you a checklist to fix them yourself. Prompt hygiene and data governance aren't glamorous, but they're the difference between an AI stack you can put in front of a client and one that ends up in a Reddit thread.

Work with BizFlowAI

If you'd rather have this built for you, that's what we do: production AI automation for solo founders and small teams — agents, integrations, and document pipelines that actually ship.

Book a free discovery call — 30 minutes, we map the highest-ROI automation in your workflow. No pitch deck, just engineering.

More guides like this on the BizFlowAI blog.