Tool · spec · October 2026
Drive audit
Shows who can see what in a whole Google Drive, from file details alone. Google stops it from opening a single document, and every report prints that refusal.
At a glance
| What it is | A program that maps a Google Drive and writes a report. |
|---|---|
| What it reads | Names, folders, owners, sharing, dates and sizes. Never what's inside a file. |
| Where it runs | On your machine, a Mac or a Linux computer. The report is written there. |
| Get it | github.com/pie-dot-zero/drive-audit. One file of Python, no packages to install, with the setup guide and the security notes beside it. |
| How it signs in | Through an app you create in your own Google Workspace, with one permission: file details. Nobody outside your organisation holds access to your Drive. |
| How fast | A Drive of about 30,000 files finished in under three minutes. |
| Works with | Google Drive. Not Microsoft 365 yet. |
| Status | A working tool. On this site since September 21, 2026. Code public since October 24, 2026. |
What the report answers
- Who can see what. Files open to anyone with the link, shared outside your organisation, or with another organisation. For each, the folder or file setting it inherits from. The report leads with those settings, because that's where the work is.
- What has gone stale. Every file by when it last changed, the ones untouched for years, and the ones you own but have never opened.
- Who your files depend on. Owners and last editors, by organisation. A folder owned by someone who has left is a problem you find out about the day you need it.
- Where the duplication and sprawl are. Exact duplicates among uploaded files, the same document in six versions, empty folders, and the trash still counting against your quota.
How it proves it can't read your files
- It asks Google what its permission allows. Google answers, not the audit's own code.
- It tries to open one of your documents. Google refuses.
- The refusal, with Google's reason, is the first thing in the report. You don't have to take my word for it; you can read it.
- If Google ever allowed it, the audit stops before scanning and writes nothing.
Ground rules
- Every number says how many files it could check, and why it couldn't check the rest. Drive hides sharing on files you can only view, and has no checksums for native Google Docs.
- Google classes this permission as restricted, so an app I owned would show you an "unverified" warning. That's why you create the sign-in in your own Workspace. It's a one-time setup; the guide in the repository walks you through it, and I will if the guide doesn't.
Runs today, and not yet
Runs today, on Google Drive:
- Maps a Drive from its metadata and writes the report on the machine that runs it.
- Traces exposed files back to the sharing settings they inherit from.
- Finds stale files, exact duplicates among uploaded files, version sprawl, empty folders and the trash.
Not yet, planned and not built:
- A Microsoft 365 version, for OneDrive and SharePoint.
- A second pass that reads documents, on your machine with no cloud model, to group files by subject. It needs a broader permission and a separate decision from you.
- A sign-in app verified by Google, so a firm with no Google Cloud project can skip the setup.
How it got this way
- Sep 21
- Published here as a service page: run it on your Drive, then decide.
- Oct 2026
- Rewritten as this spec. On the wall it's now a tool, drawn with the three ideas that lead into it.
- Oct 24
- The code went public on GitHub, so anyone can run it without me. A tool on this wall has to be something you can run yourself.
What it cannot tell you
It reads metadata, so it can tell you a file exists, who can reach it and when it last changed, not what it says. Duplicates among native Google Docs can't be proven from metadata, so they show up as version sprawl to look at, not a verdict. Grouping by file name works on document-heavy Drives and poorly on photo-heavy ones. If a claim here outruns what the audit does, that's a bug as serious as a crash.
Run it yourself: github.com/pie-dot-zero/drive-audit has the code, the sign-in setup guide and the security notes. If you get stuck, or want to go through the report together, patrick@pi0.co. You keep the report either way.