Lost $300 due to an API key leak from "vibe coding" – Learn from my mistake
I just learned an expensive lesson and wanted to share it here so others don’t make the same mistake.
I recently lost $300 because of an API key leak. It started with a surprise $200 charge from Google Cloud, and when I looked into it, I found another $100 charge from the day before. Both were for Gemini API usage that I never intentionally set up.
After digging, I discovered the issue: I had hard-coded an API key in a script that was part of a feature I ended up deprecating. The file was only in the codebase for two days, but that was enough for the key to leak. Google actually sent me alerts about unusual activity, but I missed them because they went to a less-frequently-checked email account.
Here’s what I learned:
Never hardcode API keys - Use environment variables or a .env file, even for temporary code.
Set up billing alerts - Google Cloud (and other providers) let you set up alerts for unexpected charges.
Check all linked emails - Don’t ignore notifications, even if they’re sent to secondary accounts.
Don’t rely solely on GitHub’s secret scanning - It’s useful, but renaming variables can bypass it.
This happened while I was experimenting with "vibe coding" (letting AI generate code quickly), but I realized too late that human oversight is still crucial, especially for security.
Hope this helps someone avoid the same costly mistake!
TL;DR: Hard-coded an API key in a deprecated script, key leaked, and I got charged $300. Always use environment variables and set up billing alerts!
I always wish you could kill switch a billing alert on any cloud service - so if it goes above my prescribed limit just take it offline
Most support this (e.g. AWS's free tier, Microsoft's Monthly Student Credit), but intentionally won't let customers manually set it. It isn't an oversight that they don't offer this, it is an intentional choice.
I think this bad-choice backfires though. I spend less time learning Cloud Services because the risks without a hard-limit are too high.
> human oversight is still crucial, especially for security
always always always: code review everything AI makes (CREAM)
it also helps if you understand what it’s writing. the only way to do that is to… review the code
I hate API keys. We need to get rid of them. Everyone who can influence this ... please do.
The alternative? JWT or suchlike. Authenticate each session with zero trust.
At big corp work everything is Okta / JWT / Yubikey etc. Very very occasionally an API key.