A preview picture of the documents first page is shared whether the user has permissions or not.
The entire document is not shared like what the title seems to suggest.
For sensitive documents, this can certainly be a leak but its not outright sharing in a traditional sense.
It may not be as astronomically bad as you immediately imagined, but I don't see how the nuance makes any material difference with the urgency in which this would need to be contained/analyzed/investigated and reported timely where required.
So that whole, “This page intentionally left blank”, is a security feature?
Companies can turn off the Google Drive app in their Slack workspace and block it in Google Workspace admin (and generally allowlist which apps can request Drive permissions: https://support.google.com/a/answer/7281227?hl=en ).
As the sender of the slack link, Slack should give the option to include the preview or not, like it does for other unfurl’s.
Where there would be a major problem is if someone could trick slack to generate a preview of a link they don’t have access to.
Secondarily, I have seen slack show an obsolete preview, which could result in something accidentally shared.
or sensitive company secrets
or relevant details of business deals
or is a payslip
etc etc.
It is a horrible breach, that shouldn't exist and should be fixed ASAP. Also due to GDPR concerns.
Saying that it is non issue is very short sighted.