Today: stop the spending
Set a spending limit
Most AI and hosting services have a monthly cap or a budget alert in their billing settings. Set one a little above a normal month.
Replace any key that could be public
If the bill comes from a service your app reaches with a key, create a new key and revoke the old one. If someone copied the old key, that ends it.
Pause the costly feature if you need to
If one feature, like an AI chat, is behind the bill, switching it off for a day costs less than another bill.
Tell the provider
If the charges aren’t from your users, contact the provider’s support. Many will review charges you report quickly.
Find the cause
- A copied key. Look at the provider’s usage page by day and by key. Spending that doesn’t match your users usually means someone else has your key.
- A feature anyone can call. If your app reaches an AI service through a backend function that doesn’t check who’s asking, anyone who finds it can use your AI on your bill. Hiding a button doesn’t lock it.
- Bots. Fake sign-ups, form spam or scraping can run up database, email and bandwidth costs. Look for bursts of strange accounts in your sign-up list.
Make sure it doesn’t happen again
- Keep every key that costs money on the server. The website should never hold one.
- Every function that calls a paid service should check that a signed-in user is asking, and limit how often one person can call it.
- Keep the spending limit on. It’s the cheapest protection there is.
Sources
Spending limits and safe keys (providers’ docs)