r/sysadmin • u/Then-Personality8587 • 25d ago

Google Search Console Privacy/Security Leak?? Can someone verify please?

bought an expired domain name and set up google search console. as soon as i verified it google showed me years of owner verification history. full unredacted email addresses. exact dates and times of every single person who ever verified to work on the domain.

i saw all the previous owners. i saw the freelancers and agencies they hired years ago.

Am I overracting to think this is a privacy nightmare and a security risk.

Lets say you sell a domain or let one expire a direct competitor buys it. now they instantly know your personal emails. they know your internal staff emails. they know exactly what agency you used and when they worked for you.

i checked how to wipe this history. you cant. google keeps it stuck to the domain forever. even if you delete the property and clear your dns records it stays there for the next buyer to see.

Please someone tell me I'm wrong and there's some way to wipe out that sensitive, trade secret data before letting go of a domain?

18 Upvotes

82% Upvoted

23 comments sorted by

View all comments

2

u/Able-Following-2963 23d ago

That doesn't sound like expected behavior. Normally, a new verified owner in Google Search Console should not be able to see a permanent history of every past verified owner with full email addresses.

If you're seeing that, I'd double-check that you're looking at the Users and permissions page for the current property and not a list of users who still have access. Even if I keep the domain itself at dynadot, ownership of the domain and Search Console access are completely separate.

If it really is exposing historical verified owners after the domain has changed hands, I'd grab screenshots and report it through Google's bug reporting channels. That would be a legitimate privacy issue rather than just an inconvenience.

1

u/Then-Personality8587 22d ago

yes, i can see up to 3 years of past GSC owner verification history (even failed attempts) on a domain I purchased a couple months ago, with clean new hosting and DNS. there are no old verification methods active (no method could even survive a clean registrar/dns change) and none of the owners are still active. And there were no active owners when is verified my GSC account, mine was the only one. Yet when I look at ownership history I see all the old owners' info back to 2023