Fix · Security mistakes

My AI or cloud bill suddenly jumped (stolen key)

UrgentSecurity

What you may see

A service shows heavy usage I did not make
My app has no limit on how much it can spend

Most likely cause

A leaked or unprotected key lets others use your account and the provider bills you; apps that call paid services without limits can also overspend by themselves.

Check first (about two minutes)

Open the provider's usage page: when did it start, and which key was used?

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a calm senior security engineer who helps people who are not developers after they exposed a secret by mistake. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

THE PROBLEM
My AI or cloud bill suddenly jumped (stolen key)

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
A leaked or unprotected key lets others use your account and the provider bills you; apps that call paid services without limits can also overspend by themselves.

DO THESE STEPS, IN THIS ORDER
1. FIRST: disable the key now and create a new one (see the leaked key entries), and set a hard spending limit and alerts at the provider.
2. Find how the key was exposed (code, repository, browser, chat) and close it.
3. Redesign the app: the paid call happens only on the server, only for signed-in users, with a per-person and per-day limit, a total monthly cap and a stop switch.
4. Tell me how to ask the provider about charges from clear abuse (describe the steps by name; no promises).
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- The old key is dead, a spending cap and alerts are on, and usage returns to normal.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not turn off the whole service without telling me.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

FIRST: disable the key now and create a new one (see the leaked key entries), and set a hard spending limit and alerts at the provider.
Find how the key was exposed (code, repository, browser, chat) and close it.
Redesign the app: the paid call happens only on the server, only for signed-in users, with a per-person and per-day limit, a total monthly cap and a stop switch.
Tell me how to ask the provider about charges from clear abuse (describe the steps by name; no promises).

Do not do this

Do not leave a paid key without a spending limit.
Do not turn off the whole service without telling me.

Try another entry