> Are there recommended safeguards beyond ... moving calls server-side?
This implies the API calls originated in the client, suggesting the client may have had they API key.
€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
11–20 of 325 posts
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#12i have seen this so many times... i'm thinking it's time we replaced api keys. some type of real time crypto payment maybe?
Prepaid only is a fantastic idea, especially for dumb-ass startups. Limiting your liability to $100 or so sound like a big-ass W.
Prepaid only is a fantastic idea, until your site goes (desirably) viral and then gets shut off right as traffic is picking up, or you grow steadily and forget to increase your deposit amount and suddenly production is down. Billing alerts are a much better solution IMHO.
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#13Considering the amount of repositories on public GitHub with hard-coded Gemini API tokens inside the shared source code (https://github.com/search?q=gemini+%22AIza%22&type=code), this hardly comes as a surprise. Google also has historically treated API keys as non-secrets, except with the introduction of the keys for LLM inference, then users are supposed to treat those secretly, but I'm not sure everyone got that memo yet.
Considering that the author didn't share what website this is about, I'd wager they either leaked it accidentally themselves via their frontend, or they've shared their source code with credentials together with it.
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#14i have seen this so many times... i'm thinking it's time we replaced api keys. some type of real time crypto payment maybe?
Prepaid only is a fantastic idea, especially for dumb-ass startups. Limiting your liability to $100 or so sound like a big-ass W.
Implementing this in any meaningful manner quickly begins to look like every read becoming a globally synchronised write. Of course it doesn't have to be perfect, but even approximating perfection doesn't look much different. Also, can you imagine the kind of downtimes and complaints that would inevitably originate from a fully synchronous billing architecture?
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#15[flagged]
> — billing alerts fire in hours, damage happens in minutes.
And why do you need to use AI to tell us that. How much shorter could the prompt have been?
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#16That's fucking bonkers that nothing in the system could see this as unusual and worthy of throttling. The embarrassment of this -- that a company LITERALLY SELLING machine learning services and expertise -- cannot spot such a thing... This should have led them to deal with this internally and refund it. Just... Wow Google.
This is GCP's revenue model, lol. Let's provide a (semi) generous free tier and trick people into accidentally going over it.
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#17Unfortunately, yet just another story like this. One of these unexpected usage charges in the thousands appears every month, and with the same automatic denied too. This is one of the reasons I just stopped using these kinds of pay-per-usage cloud services long ago. At best, I still use services that have hard-bounded usage limits, like EC2 from AWS, where one instance can never go beyond 24h/day usage and is always capped, with shutdowns when exceeded, and limited credit cards, too.
It's super frustrating that this is the only option to realistically deal with this issue, since all stories end up the same way: The cloud company just saying "f* you, we don't care, pay up." and legal fees are always expensive :(
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#18i have seen this so many times... i'm thinking it's time we replaced api keys. some type of real time crypto payment maybe?
Prepaid only is a fantastic idea, especially for dumb-ass startups. Limiting your liability to $100 or so sound like a big-ass W.
Yes, pre-paid would be fine and it's a well-understood pattern.
No need to retire API keys.
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#19Earlier quoted context omitted.
Prepaid only is a fantastic idea, especially for dumb-ass startups. Limiting your liability to $100 or so sound like a big-ass W.
Prepaid only is a fantastic idea, until your site goes (desirably) viral and then gets shut off right as traffic is picking up, or you grow steadily and forget to increase your deposit amount and suddenly production is down. Billing alerts are a much better solution IMHO.
Prepaid/paid limits with shutoff is appropriate for this though.
If you have per key limits, this is not possible, and even in a wild situation you should b able to expect that your firebase key will not use 50k.