[flagged]
Flagged
€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
61–70 of 325 posts
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#62Considering the amount of repositories on public GitHub with hard-coded Gemini API tokens inside the shared source code ( https://github.com/search?q=gemini+%22AIza%22&type=code ), this hardly comes as a surprise. Google also has historically treated API keys as non-secrets, except with the introduction of the keys for LLM inference, then users are supposed to treat those secretly, but I'm not sure everyone got that…
theres not a single real gemini api key in the results
Try this one. Should remove most readme keys:
Edit: self censor based on a request
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#63As others have said, this is a "feature" for Google, not a bug. There is no easy way to set a hard cap on billing on a project. I spent the better time of an hour trying to find it in the billing settings in GCP, only to land on reddit and figuring out that you could set a budget alert to trigger a Pub/Sub message, which triggers a Cloud Function to disable billing for the project. Insanity.
My favorite Google LLM benchmark is asking Gemini models to create a script that fetches API usage (just request counts) for a project from GCP.
100% failure rate.
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#64> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours. By the time we reacted, costs were already around €28,000. I had a similar experience with GCP where I set a budget of $100 and was only emailed 5 hours after exceeding the budget by which time I was well over it. It's mind boggling that features like this aren't prioritized. Sure it would probably make Google…
Exactly my thoughts, can not really understand how delayed alerts are acceptable... Have you managed to settle the cost with Google, what was the outcome?
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#65Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#66Also, can't you tie a key to a domain or IP address to help stop unauthorized usage?
Not if its publicly called from Javascript, as your user's browser will make those requests. You neither know their IP addresses, nor is the referer or origin header a safe choice as it can be spoofed outside of a browser.
If it's called from Javascript in the browser, it's not a secret API key....
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#67I said this when this finding was originally posted and I'll say it again: This is by far the worst security incident Google has ever had, and that's why they aren't publicly or loudly responding to it. It's deeply embarrassing. They can't fix it without breaking customer workflows. They really, really want it to just go away and six months from now they'll complete their warning period to their enterprise contracts…
What does this have to do with security?
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#68Can you pre-load money into your account and have that be used until it's zero, at which time you have to load more? Deepseek does it this way.
Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#69Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
#70Earlier quoted context omitted.
Um. What? In what world are API keys not secrets?
In the frontend world where you have client-side API keys talking directly to 3rd party services from the client. Think things like Google Maps and similar.
Which is a stupid idea for something where there is billing involved... Anyone on the internet can take that key and scrape the Google maps API (faking the referer header) and cost you $$$$$.
Google should have simply done with by origin URL if they wanted stuff to be open like that.