A file security protection method and system. The method is performed by an operating system of a computer system. A metadata token is received from a software application executing on the computer system. The metadata token denotes that the application has opened a file. The metadata token includes the name of the file. An initial time is set to about a time at which the metadata token was received. A loop is executed. Each iteration of the loop includes determining whether a first or second condition has been satisfied. The loop is exited if it is determined that the first or second condition has been satisfied. The first condition is that an elapsed time relative the initial time exceeds a specified threshold. The second condition is that a closeout token denoting that the file has been closed has been received from the application.