€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

Re:€54k spike in 13h from unrestricted Firebase browser key ... by ai_slop_hater on Thursday April 16, 2026 @10:26AM (#47793449)

You can try implementing rate limiting and not exposing your API keys to the public.

[ Parent | on HN ]

Re:€54k spike in 13h from unrestricted Firebase browser key ... by Leomuck on Thursday April 16, 2026 @10:37AM (#47793631)

Yes, and you should! But not doing so resulting in this seems kind of over-the-top. Basically means an oversight can result in your bankcruptcy?

[ Parent | on HN ]

Re:€54k spike in 13h from unrestricted Firebase browser key ... by buzer on Thursday April 16, 2026 @12:26PM (#47795801)

Google has specifically said that certain API keys like Firebase are not secrets (since people will find them)... though Gemini then ended up changing stuff. https://news.ycombinator.com/item?id=47156925

[ Parent | on HN ]

Re:€54k spike in 13h from unrestricted Firebase browser key ... by subscribed on Thursday April 16, 2026 @02:06PM (#47797242)

You're supposed to drive slow and careful, and not rely on seatbelts and airbags.

[ Parent | on HN ]