Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

261–270 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#261

Earlier quoted context omitted.

Yeah, that the main reason I never use services like Google Cloud if I don't have to, it's impossible to have a hard cap, and anyone pretending to be an expert, is just off. Google says that they can't provide a hard cap because that would mean shutting down all your services..bla bla, but at least give users the option.

We have spend caps at the billing account level and the project level (developer set) in the Gemini API now. There is up to a 10 minute delay in processing everything but this should significantly mitigate the risk here: https://ai.google.dev/gemini-api/docs/billing#tier-spend-cap... By default, new Tier 1 paid accounts can only spend $250 in a given month.

How much of a bill can you run up in 10 minutes?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#262

Earlier quoted context omitted.

It’s not fair. Google, Amazon, Microsoft… they have never played fairly. They will never do.

you cannot earn billions a year and not be cheating your users out of their money. its that simple. they dont care for people, otherwise they wouldnt be putting so much effort in making them poor.

What about their behavior makes you think they are a company that doesn't care for people?

https://nypost.com/2026/04/15/business/amazon-warehouse-empl...

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#263

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

Yet my phone service provider is able to cut off my internet access from the Kb I go over the limit…

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#264

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

Happened to me to, luckily only was 40$, restricted the api the next day. They were using gemini 3 flash which I am not using.

That’s users, for ya! They will always find ways to use your product that you didn’t intend to or even knew about!

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#265

Earlier quoted context omitted.

you cannot earn billions a year and not be cheating your users out of their money. its that simple. they dont care for people, otherwise they wouldnt be putting so much effort in making them poor.

What about their behavior makes you think they are a company that doesn't care for people? https://nypost.com/2026/04/15/business/amazon-warehouse-empl...

Wtf. Just wtf.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#266

Earlier quoted context omitted.

We have spend caps at the billing account level and the project level (developer set) in the Gemini API now. There is up to a 10 minute delay in processing everything but this should significantly mitigate the risk here: https://ai.google.dev/gemini-api/docs/billing#tier-spend-cap... By default, new Tier 1 paid accounts can only spend $250 in a given month.

How much of a bill can you run up in 10 minutes?

[deleted]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#267

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

Yeah, that the main reason I never use services like Google Cloud if I don't have to, it's impossible to have a hard cap, and anyone pretending to be an expert, is just off. Google says that they can't provide a hard cap because that would mean shutting down all your services..bla bla, but at least give users the option.

It shouldnt mean shutting down all your services, it should mean not letting you provision new ones and limiting the scope of what you can continue doing.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#268

Earlier quoted context omitted.

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

You can try implementing rate limiting and not exposing your API keys to the public.

You're supposed to drive slow and careful, and not rely on seatbelts and airbags.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#269

Earlier quoted context omitted.

Yeah, that the main reason I never use services like Google Cloud if I don't have to, it's impossible to have a hard cap, and anyone pretending to be an expert, is just off. Google says that they can't provide a hard cap because that would mean shutting down all your services..bla bla, but at least give users the option.

It shouldnt mean shutting down all your services, it should mean not letting you provision new ones and limiting the scope of what you can continue doing.

If I budget enough to store 1TB of data for 1 month, then on the first day of the month I store 2TB of data - what should the behaviour be after 15 days?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#270

Hey folks, I just wanted to drop a quick note here that there’s a way to stop billing in an emergency that’s officially documented on the Google Cloud documentation site: https://docs.cloud.google.com/billing/docs/how-to/disable-bi... . You can see the big red warning that this could destroy resources that you can’t get back even if you reconnect a billing account, but this is a way to stop things before they get out…

>There's a delay between incurring costs and receiving budget notifications, so you might incur additional costs for usage that hasn't arrived at the time that all services are stopped.

This delay may be hours or days. I managed to spend $400 in 5 minutes.

Post reply on HN