Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

251–260 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#251

Post by saidnooneever »

sdevonoes wrote: post #157
Leomuck wrote: post #145

Earlier quoted context omitted.

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

It’s not fair. Google, Amazon, Microsoft… they have never played fairly. They will never do.

you cannot earn billions a year and not be cheating your users out of their money. its that simple. they dont care for people, otherwise they wouldnt be putting so much effort in making them poor.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#252

Post by buzer »

ai_slop_hater wrote: post #194
Leomuck wrote: post #145

Earlier quoted context omitted.

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

You can try implementing rate limiting and not exposing your API keys to the public.

Google has specifically said that certain API keys like Firebase are not secrets (since people will find them)... though Gemini then ended up changing stuff. https://news.ycombinator.com/item?id=47156925

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#253

Post by [deleted] »

jasonjmcghee wrote: post #80
p2detar wrote: post #28

I read the following [0] and immediately went to my firebase project to downgrade my plan. This is horrific. > Yes, I’m looking at a bill of $6,909 for calls to GenerativeLanguage.GenerateContent over about a month, none of which I made. I had quickly created an API key during a live Google training session. I never shared it with anyone and it’s not pushed to any public (or private) repo or website. 0 - https://disc…

So someone took a picture of the key at the live training session or something? What's the suspected cause?

[deleted]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#254

Post by [deleted] »

someothherguyy wrote: post #95
boredpudding wrote: post #53

Earlier quoted context omitted.

Google API keys have been used for ages on the frontend. For example on Google Maps embeds. Those are not possible without exposing a key to the frontend. They weren't secret, until Gemini arrived. https://trufflesecurity.com/blog/google-api-keys-werent-secr... https://medium.com/@ahhyesic/your-google-maps-api-key-now-ha... https://www.malwarebytes.com/blog/news/2026/02/public-google...

If one ignores 70% of the documentation, it makes for a demonizing blog post about it, sure. " API keys for Firebase services are not secret API keys for Firebase services only identify your Firebase project and app to those services. Authorization is handled through Google Cloud IAM permissions, Firebase Security Rules, and Firebase App Check. All Firebase-provisioned API keys are automatically restricted to Firebas…

[deleted]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#255

Post by QuercusMax »

TrackerFF wrote: post #192
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

It's like a fire alarm system that goes off 30 mins after the it senses a fire. Good stuff.

I was selling a house in a state I no longer lived in, and was under contract to close the sale, when I got an email from the water company. It told me they suspected based on my water usage that there was a leak on the properly.

There had been a very cold February night (like -15F) and a pipe froze inside the walls, and it was just absolutely gushing out. They sent me the email after it had been leaking for a WEEK. I asked a friend to check it out and she said that the laminate floor went "squish" when she stepped in the front door.

Fortunately I was covered by homeowner's insurance since I could prove that my heat had been on, but that was a very unpleasant "warning" to receive!

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#256

Post by masklinn »

sofixa wrote: post #233
ch0wn wrote: post #142

Earlier quoted context omitted.

This should be illegal. If a contractor your hired to swap out a tile on your bathroom floor billed you for remodelling your back garden, you would obviously have the legal right to refuse that.

Your analogy is well off. You hire a contractor and agree they'll bill you per tile, regardless of how many tiles there are. They bill you per tile. End of story. For a more acurate comparison, consider a utility. You agree to pay for your electic bill. It's not the utility's fault you invited all your friends who decided to run a crypto mining LAN party, and they can't cut you off lightly because it might literally…

When people created firebase keys years ago they did not expect or imagine these keys would become valid for AI that didn’t exist years down the line.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#257

Post by ajaystream »

hilariously wrote: post #227
clapthewind wrote: post #85

Earlier quoted context omitted.

Do not get hung up? Sounds like English ESL rewrote some insights for language. Content > Form.

At this point its much more polite to write badly than use an LLM to rewrite your content. The form tells me you do not care to interact with me in a genuine way.

I am going to ignore the form comments -- I guess I am not sure how I feel about being called an LLM (good or bad ?), not sure only time will tell. If LLMs turn out to be the turd of the universe -- bad or maybe good ? -- Emphasis on the '--' for comic interlude

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#258

Post by timeinput »

wing-_-nuts wrote: post #200
jubilanti wrote: post #151

Earlier quoted context omitted.

Not if your contractor had you first sign a 15 page contract that commits you to whatever costs they dream up and requires forced arbitration by a corporate friendly firm when any dispute arises. Because that's somehow normal in today's tech world.

Slightly OT, but I've always taken a dim view of this sort of thing for consumers because the parties are never at equal parity, either in ability to understand the legalese they're agreeing to, or the ability to seek alternatives. Legal contracts for consumers should be written at whatever the prevailing reading level is, and the government should step in the more monopolistic position a company is in. It infuriates…

Give me all your data and money plzthx

Dictated but not read,

big company

Alternatively (in emoji description form):

floppy disk, bar chart, right arrow, brain, money with wings, pointing finger, slightly smiling face

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#260

Post by strangattractor »

not_your_vase wrote: post #245
logankilpatrick wrote: post #170

Earlier quoted context omitted.

We have spend caps at the billing account level and the project level (developer set) in the Gemini API now. There is up to a 10 minute delay in processing everything but this should significantly mitigate the risk here: https://ai.google.dev/gemini-api/docs/billing#tier-spend-cap... By default, new Tier 1 paid accounts can only spend $250 in a given month.

I just find it extraordinary that the biggest tech company in the world can do cutting edge real time AI for millions of people, run Youtube and of course all the other google services with having literally the smartest people in the world and unlimited resources on board, but still can't keep real time track of the user's current billing and their spending limits, it's all best effort still. Somehow it doesn't add u…

If spending caps made them more money they'd find a way;)
Post reply on HN