That's probably not quite true. "google3 file access" most likely means the ability to open paths with the "google3 file library", which lets you use paths like "/gfs/<cluster>/...", and similar for all the different storage services. But you'd also need an identity with permissions to read whatever you're reading. Without an identity that's in ACLs and stuff, you'd only be able to see "world-readable" data, which is still quite serious because who knows what's lying around, but probably nothing sensitive like source code.

What is "Google3"? Incidentally, Google isn't helpful in finding out - all I get as results is garbage and some node.js package placeholders.

It's the Google monorepo: https://cacm.acm.org/magazines/2016/7/204032-why-google-stor...

Yeah, I wonder if the google3 access may have been the real reason they asked him to stop poking around.

Source? Is there really no authentication around it?

He had read access to G3. Exfiltrating it all would have been hard, but he could have gotten a chunk of it for sure.

You want the part of the write-up where it mentions he gets FILE_GOOGLE3_ACCESS.

I'm not sure what access that actually gives, but that email thread showing people getting +cc'd on the ticket speaks pretty obviously to the severity and magnitude of the problem.

(Am Googler.)