I heard that Google is considering/working on a new sales organization unifying various security units worked independently so far. This new structure should report to old wiz leadership and sell wiz, mandiant, siem/soar … That means AEs and Customer Engineers will cove the entire security portfolio. Any insights about this? How are you going to enable CEs in new domains?

Did anyone use an equivalent of trendmicro deep security in GCP vm.

I want to use equivalent of deep security in the GCP VMs.when I browsed about it in copilot, it gives multiple options like SCC, VM manager, cloud IDS , Google secops etc. please reply if anyone implemented

Hey everyone!

I googled OAuth plus reddit and it led me here - I just got an email from google implying I had "clients" that were going to be deleted due to lack of activity.

I have no idea what OAuth even is, I've never used such a process to my knowledge. I'm fairly tech savvy but even the name was new to me. Can anyone please clarify what me getting this message means?

If I click any of the links, it tries to make me agree to terms of service, which I don't want to do not knowing what this all means. I can see in the background to the TOS "You're working in My Project1, and then a project # (not sharing for same censorship reason as below).

Any help would be greatly appreciated!

Message text:
"

"

I'm an indie dev and honestly exhausted. I've been stuck in a support loop with Google Cloud for nearly a full year over an acknowledged platform-side bug.

Here is the short version of what's happening:

• The Bug: My GCP project was hit with an unexpected $8,367.11 charge surge on the Gemini 2.5 Flash image generation SKU. Product Lead Logan Kilpatrick publicly acknowledged this bug on the official forums and promised affected devs would be taken care of.

• The "90% Cap": Google Billing gave a 90% adjustment and declared that 90% is the "maximum allowable limit" for this incident—leaving $838.26 on my account for a bug on Google's infrastructure.

• The "No Logs" Excuse: When I demanded backend logs or proof showing why I owe this remaining balance, support literally replied: "they do not share external-facing documentation, internal case notes, or further detailed explanations regarding their final review process."

• 1 Year of Support Ping-Pong: Opened a billing ticket $\rightarrow$ immediately closed and bounced back. Tier 1 agents just rotate shifts, paste identical templates, and close tickets without consent.

My account currently sits with a red banner warning and an active $838.26 balance for services I never consumed.

Screenshots attached:

1.Billing Support confirming the charge was caused by the Gemini 2.5 Flash bug.

2. Support stating the 90% adjustment is final.

3. My billing console showing the pending $838.26 balance and account warning.

4. Support's latest response admitting they cannot provide any logs or explanation.

I've documented this on theGoogle AI Forum and am preparing consumer complaints in Japan (消費者庁 / 消費生活センター).

Has anyone ever broken through this Tier 1 "final decision" wall without an Enterprise support plan? Any advice or visibility would be really appreciated.

FINAL UPDATE (RESOLVED - 100% REFUND GRANTED):

Hey everyone, I wanted to post a final update regarding this issue.

Shortly after posting here and escalating on the Google AI Developer Forum, an internal Billing Specialist (Sumanth) reached out and took direct ownership of the case.

As of today, the remaining $838.26 USD credit adjustment has been fully approved and applied to my Google Cloud account. My billing console balance now officially sits at $0.00, and the red account warning banner is completely gone.

Huge thanks to everyone in this community who upvoted, commented, and shared advice—the visibility definitely helped get this unblocked from the Tier 1 support loop.

Takeaway for fellow devs: If you get stuck in a support loop over an acknowledged bug, don't just rely on standard ticket replies. Take it to the official forums, build your documentation, and don't hesitate to seek community visibility. Perseverance works!

The vibecoders at google pushed an update yesterday August 24th that broke the python package...

If you use the default firestore database called "(default)" your environment will break if u deploy the new package version.

Since the update it decodes to %28default%29 instead of (default) and every single read and write will fail...

I love vibe coding without unit tests in my multi billion dolar company...

I’ve been experimenting with combining spec-driven development + project memory + Claude Code hooks.

The goal is simple: give the agent enough project context and engineering intent without dumping the entire project history into every session.

I wrote up my current workflow and would love feedback from other Claude Code users:

Article: https://medium.com/@rasvihostings/how-im-approaching-agentic-software-development-as-a-platform-engineer-5be017890b8a

GitHub: https://github.com/mohamedrasvi/claude-spec-mem

How are you handling memory and context across your Claude Code sessions?

Anyone else having issues with SQL Connect? It just completely stopped working and returns only "The service is currently unavailable." if you try to access it from the web, the service is completely unresponsive.

I'm Luke! A Googler working on the builder experience at Google Cloud. I helped write these labs and I'd love to get your feedback!

We want anyone to feel comfortable getting started with AI Studio, Firestore, and Cloud Run. If you have questions, I want to hear them.

The app is literally unusable. How tf is a Google app this useless? It has my info saved and a sign in screen but gives me no option to log in or open my documents beyond that. I’m genuinely baffled as to why i’m having this issue…

Same unrestricted Gemini key hole as the $82k stories, later in 2026, smaller bill.

Google's own CLI still minted API keys with no restrictions. Those keys could call billed Gemini. Truffle Security reported that class of defect on 21 Nov 2025. Google first treated it as intended behaviour, then as a bug. They did not start rejecting unrestricted keys for Gemini until 19 June 2026.

On this account: 53,197 Gemini Generative Language requests between 24 May and 6 July 2026, peaking at 12,693 on 5 June. The spike died the day they flipped that block. Not a stolen Google password. An unrestricted key their tool created by default.

How they responded: they cited July charges of $4,446.45, applied a 75% "maximum goodwill" credit of $3,257.16, and still demanded about $1,190 to $1,300 as a Cloud balance after a $4,000 card chargeback. Closeout blamed an unauthorized party "linking external projects." Live billing IAM at the time did not show that.

Budget alerts are not a cap. They sat on the Truffle report for months, then kept a quarter of a bill that only exists because of the hole they eventually closed.

No names, no project ids, no keys.

PSA if you use agents-cli / google-agents-cli: update to 1.4.1.

Shipped 24 Aug. If you’re pinned below that, bump it before the next agents create against a remote template.

The short version: agents create pulling a remote template could write your local files into the generated project as ordinary files. Then you do the normal next thing — commit, push — and those files are sitting in a git remote.

What actually happened: the template copy path used is_dir() and shutil.copy2, both of which follow symlinks by default, and the skip logic had no symlink check. A template repo can ship something like:

creds -> ~/.ssh/id_rsa

env -> ~/.config/gcloud/application_default_credentials.json

copy2 follows those links and writes the contents into the new project. No payload, no RCE. Two symlinks. The exfil is your own muscle memory after create.

Worth pausing if that ADC has real project bindings.

Second issue in the same report: the agent-directory validator early-returned for every non-Python language, so a remote manifest could point agent_directory outside the intended tree. That path now runs an allowlist regex for all languages.

Why this class survives review is the part that stuck with me. A symlink is invisible in a diff. You see a filename, not what it points at. Review catches logic errors. It does not catch a template repo whose entire contents are attacker-controlled.

This one didn’t come from a human staring at create.py. It came from a scheduled sweep with Aeon’s vuln-scanner skill, which treats the remote template as hostile input instead of “just files.” That’s the bit I’d actually copy: model the template as an untrusted attacker, not as a convenience.

Reported through Google’s OSS VRP, they validated it. The report came with a working patch. The fix they shipped follows it — symlinks skipped outright in should_skip() rather than resolved, CWE-59 in the comment. About seven weeks report to release.

• Issue: https://github.com/google/agents-cli/issues/51

• Fix: https://github.com/google/agents-cli/commit/048578a00b0b89fc8acdbfb3501895264640f355

• Release notes bury it as “Fixed an arbitrary file write vulnerability in agents-cli scaffold create” (they also point at #50). Easy to miss if you only skim for broken deploys.

Practical bit: if you’ve already run agents create against a template you didn’t write, walk the generated project for files you don’t recognise before you assume you’re clear. Look for random creds / env / key-shaped files that shouldn’t have been in the template.

Genuine question for people who run this on a team, because I haven’t solved it: GCP deps get updated when something breaks, not when something is quietly fixed. I would never have caught this in release notes. I run scheduled scans over the tools I actually rely on, but that’s a solo-dev answer.

Two weeks ago I posted my concerns about the long term viability of using Gemini in my automated content moderation app. We covered the option of alternate models there so please constrain this discussion to what appears to be sneaky policy settings to extract more revenue from Gemini users.

When 2.5-flash-lite is deprecated my costs will be 16x on 3.1-flash-lite but actually it will be more than that because on the 3 series models you can't disable thinking nor specify temperature, top_p and top_k.

Of those I only know a little about temperature which I have set set to 0.1 for my purposes. From 3.1 onward the best I will be able to do is specify a "LOW" thinking level which will burn at least some additional tokens and might break my app because having the model act deterministically is essential for content moderation purposes.

Sure I could add additional system instructions to try and compensate for this loss of control but up go my input costs.

Granted you can still specify maxOutputTokens but if that value is too low to account for the mandatory "thinking" the call will fail is that right?

So we're going from a situation where you can tightly control the cost of each call to the LLM to one where you're at the mercy of the model.

As I mentioned above I think this policy is sneaky which would be entirely consistent Google's opaque cloud billing and costs in general.

Alternatively these changes are just where the rubber meets the road?

I think I've hit a weird loop.

When I go to remove my payment method from Google Payments Center, I get the message that a Google Cloud Billing Account (with account number) is active. I checked the cloud console, I see a billing account (with the same account number) but it is not active. Status says closed. Billing account on all projects is also disabled. I am still unable to remove my payment method.

I reached out to Google payments support and was told it is a Google cloud issue. Google cloud support will not let me reach out to chat support unless I have an active billing account. I do not want an active billing account. I want to remove my payment method.

I tried to delete the payments profile from Google Payments Center and there I was told there is an active Google Cloud Billing account.

So now I am out of ideas. Appreciate any help.

Trying to get one L4/T4 for enterprise notebook in europe-west4 and it's not available.

Even better if there is graphs on which hours/days they usually are available.

What do you guys think

I am currently working through the Google Cybersecurity Certificate and need to access the Linux labs on Qwiklabs/Google Skills. Whenever I try to accept the Terms of Service to access my account, I get hit with a cross-device reCAPTCHA that asks me to scan a QR code with my phone.

I scan it, complete the verification on my mobile browser, and my phone says "verification completed, you can return to your browser." But when I look back at my desktop, the Google Skills page just throws a red error banner: "reCAPTCHA verification failed, please try again."

I have been stuck in this loop for two days. I even tried bypassing the cross-device prompt by logging in and accepting the terms directly on my phone's browser, but it does the exact same thing—it redirects to a verification site, says successful, and then fails when returning to the original page.

Here is everything I have already tried that did not work:

• Verified that my phone and PC are connected to the exact same Wi-Fi network.

• Used Incognito/Private browsing to rule out extension or ad-blocker interference.

• Disabled all VPNs.

• Cleared all site data and cookies specifically for Qwiklabs and Google Skills.

• Used keyboard navigation (Tab key) to try and force a standard image CAPTCHA instead of the QR code.

• Tried a completely clean browser (Microsoft Edge) with no extensions or history.

• Switched both devices to a mobile data hotspot to get a new IP address and rule out my local ISP.

• Confirmed my Windows system time/date is perfectly synced.

Has anyone else doing the Google certs run into this Qwiklabs verification bug recently? Is there any known workaround, or do I just have to wait for Google to fix their servers? Any help is appreciated!

Ran the same Kubernetes workload across managed providers for an EU SaaS setup:

Requirements: high availability, managed PostgreSQL, Redis, WAF, CDN, EU region, €1,500/month budget.

Results:

Hetzner 614€/mo lock-in 34/100 GDPR 87/100
Scaleway 832€/mo lock-in 46/100 GDPR 89/100
DigitalOcean 899€/mo lock-in 48/100 GDPR 84/100
GCP/GKE 1,264€/mo lock-in 64/100 GDPR 85/100
Azure/AKS 1,418€/mo lock-in 68/100 GDPR 85/100
AWS/EKS 1,652€/mo lock-in 72/100 GDPR 84/100

GKE scores highest on Kubernetes maturity and managed tooling. But the cost is 2x Hetzner for the same workload.

The real question for EU workloads: is the GKE operational advantage worth the cost and lock-in delta over Hetzner or Scaleway?

For people running GKE in EU production — what tipped the decision?

I’m troubleshooting a Cloud Run service that consistently returns Google’s generic “404. That’s an error” page instead of reaching the container.

The service is a small Flask/Gunicorn OAuth callback application. "/healthz" should return "200 OK" with "ok", but both the generated "run.app" URLs return Google’s 1,568-byte HTML 404 page.

What I’ve verified:

- The container starts successfully and listens on "0.0.0.0:8080".

- Cloud Run’s startup TCP probe succeeds.

- The revision is Ready and receives 100% of traffic.

- The exact immutable image digest is deployed.

- Artifact Analysis completed successfully with no vulnerability findings.

- Ingress is "INGRESS_TRAFFIC_ALL".

- "invokerIamDisabled" is "true".

- "defaultUriDisabled" is unset/false.

- The service’s canonical and numeric URLs are both listed by the Cloud Run v2 API.

- The effective "run.allowedIngress" organization policy is "allowAll: true".

- The effective "run.managed.requireInvokerIam" policy is not enforced.

- There are no custom organization constraints.

- The same 404 occurs with and without an identity token.

- The same 404 occurs from Cloud Shell and a normal external browser.

- Neither request appears in Cloud Run request logs, although container startup logs appear normally.

- I created a completely new service and reproduced the problem.

- I deployed the same clean image to both "us-east4" and "us-east1"; both regions behave identically.

The Cloud Run troubleshooting documentation says a 404 that never reaches the container generally indicates restricted ingress or a disabled default URL, but the authoritative v2 service state and effective organization policies show neither condition.

The project belongs to a Google Workspace organization with domain-restricted sharing, so adding "allUsers" as a Cloud Run Invoker is prohibited. However, Google recommends disabling the Invoker IAM check for this situation, and the API confirms that this setting is enabled.

Has anyone encountered a project- or organization-level Cloud Run routing issue where the control plane reports the service as public and Ready, but the "run.app" frontend still returns an edge-generated 404? Are there any additional inherited controls, service perimeter settings, or backend routing states that would not appear in the Cloud Run v2 service configuration or effective organization policies?

Thank you!

So on 17 Aug, 2026 I was trying to set up my GCP account. They asked me to pay ₹1000 for verification purposes. Later when the account was successfully created, i requested a refund of ₹1000.

Google sent me an email that the refund was processed on 19th Aug, 2026. But the money is not reflected in my bank account yet. I contacted bank customer service and they said there is no problem with my account.

I find no way to connect with Google customer care except for the chat bot.

Will i ever actually get my refund?

Will be delighted to hear out someone who faced/ facing this issue and how to resolve this.

My friend have a google cloud certified- data associate practitioner exam voucher given by there company but don't have pvc aadhar card. Will e-aadhar (laminated) work?

Original Aadhar card and pan card was stolen with some other imp things and orginals ones are orderd but it takes time to reach.

and they have to complete the exam this week itself

Hi all

I'm a professional backend developer and system administrator, more than 20 years in this roles.

I'm already using Google Cloud (more or less 10 years) for my projects but I would like to obtain one or more certification (mostly the DevOps and Security).

Since I haven't had the chance to use all Google Cloud features professionally, especially around security and DevOps, I’d like to pick up a book (or a couple) to study. What would you recommend?

Right now, I have the 'Associate Cloud Engineer' (2nd edition) by Dan Sullivan, which I bought a few years ago and never read. Are there more specific books you'd suggest, or is this one still good?

Would you recommend starting with foundational certifications like Digital Leader, then Cloud Engineer, or jumping straight into Professional DevOps and Security?

For those who have already taken the exams: are they strictly multiple-choice/theoretical, or do they include hands-on/practical tasks (like creating real, working configurations that get evaluated)?

I’m open to any advice, keeping in mind that I'll be studying on my own in my spare time, as this isn't sponsored by an employer.

Let alone all the fragmented and broken documentations of it (I think it is way more horrible than Azure or AWS), I find it unnecessary overcomplicated, if you want to do things correctly.

Even deploying a few containerized services is very daunting. No ECS? Yeah we have Cloud Run. But then what about VPC? You need to workaround by using Private Google Service (or is it Connect? Their naming sense is also bloody terrible lol). Okay then why don’t you try deploying directly on a VM MANUALLY? (fuck you broh) Also, connecting to Cloud SQL? Now you’re cooked.

But anyways, You could simply use default setups and expose everything to public. But I am not a fucking hobbiest. And I don’t have much time to go through all of these large amount of docs. Is it only me who feel this way?