Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

91–100 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#91

Post by sillysaurusx »

dminik wrote: post #62
ckbkr10 wrote: post #38

Earlier quoted context omitted.

theres not a single real gemini api key in the results

Try this one. Should remove most readme keys: Edit: self censor based on a request

I know you're well within your rights to post this, but would you consider replacing your comment with something like "It's easy to find working keys on github if you search the appropriate terms"?

Think of it this way: although you're not to blame, HN drives a lot of traffic to your preconfigured github search. There are also bad actors who browse HN; I had a Firebase charge of $1k from someone who set up an automated script to hammer my endpoint as hard as possible, just to drive the price up. Point being, HN readers are motivated to exploit things like what you posted.

It's true that the github search is a "wall of shame", and perhaps the users deserve to learn the hard way why it's a good idea to secure API keys. But there's also no benefit in doing that. The world before and after your comment will be exactly the same, except some random Gemini users are harmed. (It's very unlikely that Google or Github would see your comment and go "Oh, it's time we do something about this right now".)

EDIT: I went through the search results and confirmed that the first several dozen keys don't work. They report as error code 403 "Your API key was reported as leaked. Please use another API key." or "Permission denied: Consumer 'api_key:xxx' has been suspended." So at least HN readers will need to work hard(er) to find a valid key.

I wonder how you report a gemini API key as leaked... Searching "report gemini api key leaked" on Google only brings up similar horror stories (a $55k bill, waived https://www.reddit.com/r/googlecloud/comments/1noctxi/studen...) and (a $13k bill from 3d ago https://www.reddit.com/r/googlecloud/comments/1sjzat3/api_ke...)

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#92

Post by villgax »

benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

Shirky’s principle at work is all

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#93

Post by CWwdcdk7h »

comrade1234 wrote: post #68

Can you pre-load money into your account and have that be used until it's zero, at which time you have to load more? Deepseek does it this way.

Google doesn't allow disconnecting credit card from account unless you close it. That includes situation when you are just trying out free tier.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#94

Post by benterix »

Hamuko wrote: post #81
JohnScolaro wrote: post #50

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours. By the time we reacted, costs were already around €28,000. I had a similar experience with GCP where I set a budget of $100 and was only emailed 5 hours after exceeding the budget by which time I was well over it. It's mind boggling that features like this aren't prioritized. Sure it would probably make Google…

Which cloud provider actually prioritises features that cut off your money supply? Because AWS sure as shit doesn't either.

Amazon, Microsoft and Google don't offer hard cap. Most other/smaller public cloud providers do. The reasons are quite obvious.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#95

Post by someothherguyy »

boredpudding wrote: post #53
singpolyma3 wrote: post #39

Earlier quoted context omitted.

Um. What? In what world are API keys not secrets?

Google API keys have been used for ages on the frontend. For example on Google Maps embeds. Those are not possible without exposing a key to the frontend. They weren't secret, until Gemini arrived. https://trufflesecurity.com/blog/google-api-keys-werent-secr... https://medium.com/@ahhyesic/your-google-maps-api-key-now-ha... https://www.malwarebytes.com/blog/news/2026/02/public-google...

If one ignores 70% of the documentation, it makes for a demonizing blog post about it, sure.

" API keys for Firebase services are not secret

API keys for Firebase services only identify your Firebase project and app to those services. Authorization is handled through Google Cloud IAM permissions, Firebase Security Rules, and Firebase App Check.

All Firebase-provisioned API keys are automatically restricted to Firebase-related APIs. If your app's setup follows the guidelines in this page, then API keys restricted to Firebase services do not need to be treated as secrets, and it's safe to include them in your code or configuration files. Set up API key restrictions

If you use API keys for other Google services, make sure that you apply API key restrictions to scope your API keys to your app clients and the APIs you use.

Use your Firebase-provisioned API keys only for Firebase-related APIs. If your app uses any other APIs (for example, the Places API for Maps or the Gemini Developer API), use a separate API key and restrict it to the applicable API."

https://firebase.google.com/support/guides/security-checklis...

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#96

Post by varispeed »

benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

This is clearly setup for VC backed companies where shareholders don't care about spend as long as they can brag about investing in this cool start up at dinner parties. Normal and true business should stay away.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#97

Post by PunchyHamster »

mcccsm wrote: post #40

Two things that should be default on any GCP project touching generative-AI APIs: 1 API-key restrictions by HTTP referrer AND by API (`generativelanguage.googleapis.com` only), 2 a billing budget with a Pub/Sub "cap" action, not just an email alert. Neither is on by default, and almost nobody sets them before shipping. 13 hours is actually fast for detection. most teams find out at end-of-month reconciliation.

I want API keys with monthly and hourly quotas and RATE LIMITING.

like 50k requests per hour, above that 1/s/client up to 20 req/sec.

I don't want to shotgun my service for every user if one user is misbehaving. I want to set rate of bleeding

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#98

Post by Maxious »

benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

> The Gemini API supports monthly spend caps at both the billing account tier and project levels. These controls are designed to protect your account from unexpected overages, and the ecosystem to ensure service availability

https://ai.google.dev/gemini-api/docs/billing#project-spend-...

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#99

Post by [deleted] »

onemoresoop wrote: post #58
dabedee wrote: post #42

As others have said, this is a "feature" for Google, not a bug. There is no easy way to set a hard cap on billing on a project. I spent the better time of an hour trying to find it in the billing settings in GCP, only to land on reddit and figuring out that you could set a budget alert to trigger a Pub/Sub message, which triggers a Cloud Function to disable billing for the project. Insanity.

Call it for what it is, an antifeature, a trap for the user.

[deleted]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#100

Post by genxy »

sillysaurusx wrote: post #76
zanbezi wrote: post #64

Earlier quoted context omitted.

Exactly my thoughts, can not really understand how delayed alerts are acceptable... Have you managed to settle the cost with Google, what was the outcome?

Back in 2020 I had a similar situation. Ended up charging $500 due to an overnight TPU training run using egress bandwidth across zones. Google support was surprisingly understanding, after I explained the issue. They asked some clarifying questions. Then they said that they can offer a one time refund for this case. Since then I was paranoid not to accidentally do it again. I don't know whether GCP would refund a se…

GCP charging for interzone traffic is an interesting financial choice. They own all the infra and in many cases this is literally moving from building to building.
Post reply on HN