Experience in investigating corporate cloud storage public link leakage alerts

I once encountered this pitfall during a security inspection at a SaaS company: a DLP alert indicated that someone had placed a customer list into a publicly shared link, but the alert only provided the filename and the operator. At the time, if I had only dealt with the most obvious surface-level issue, it might have seemed resolved in the short term, but it would definitely have recurred…