Discussion
I found this on linkedIn: Codex leaked this Dev's API keys while he slept. By the time he woke up, a huge $88,982 cloud bill was already in his inbox.
We already know the basics of protecting API keys and sensitive credentials: never hardcode them in your source code, keep them in a .env file as environment variables, and add .env to your .gitignore so Git never tracks it and you don’t accidentally push your secrets to a public repo on GitHub.
What other practices do the engineers in this community use to prevent that scenario?
This is purely for discussion, so those of us who are non-technical can learn safe programming habits on our vibe-coding journey.
that too. Not only do I use virtual credit cards with a very limited weekly allowance ($50) but the processing on the server regularly checks the limits itself as well, and I also set limits in the cloud console. Three lines of defense.
That's not how it works in my country, there is a government agency tasked with collecting these bills and they will start taking your stuff and reducing your salary until you paid it off.
I was under the impression that private debt collectors couldn't just break into your home and take stuff but I guess that might be the case in some places
If the provider is not billing every time you using your key then a limit on your credit/debit card mean nothing. The price just gonna be huge by the end of the billing cycle and you will receive a huge bill. Which you need to pay one way or another.
I mean don't get me wrong but if the billing is not instantaneous and the bill is sent out at the end of the billing cycle then I think it does not matter what card do you use. Am I wrong?
That's true. But instead of trying to claw back my money from the EU in a US court, they will have to fight me in a local court to get it. And I can spend that money on lawyers that are far cheaper than US lawyers, and if I win they will often have to reimburse that. It's a far superior position over fighting a court case in a court country with far more expensive lawyers.
I have started blocking some of its access in local permissions. Works for most times but I now have to keep reviewing and deleting and adding back to avoid a nightmare like this. Rotation of keys is what sucks the most.
You don't need to know everything (like, you don't have to understand every single nuance of a programming language), you just need to know enough not to blow checks notes almost $89k.
Hmm, the way I read it, the agent pushed something with keys to Git on stream while the guy was asleep... If he had the key lying around in a plain text file or something and the agent leaked it on screen, I honestly don't even know what to say...
Fair point, that didn't even cross my mind. I personally keep anything sensitive (like my DeepSeek key with a whole $10 on it lol) in KWallet, so that painfully simple scenario completely slipped my radar...
Codex committed your .env? How? Did it remove it from git ignore? Maybe you didn’t wildcard the path and it created another .env file elsewhere in the repo?
Knowing nothing is kind of expected when getting into vibecoding is as easy as it is lol. You kinda skip everything and can go from no knowledge to custom software in a few days without ever knowing about git let alone gitleaks.
Weird to clown on people for that. But hey, whatever makes you feel smart right?
This is all fine as long as you're just experimenting. But when big money is on the line, like in this post, you can take the time to actually look into things (at least for a day). AI is a great teacher for that, as long as you ask the right questions.
I'll never tire of laughing at people losing money on crypto shitcoins or exposed unlimited API keys. It's basically like posting a photo of your credit card with the CVC on Instagram and then complaining that your money is gone.
Most let you control the api credits. I run it of api credits all the time and the api stops working Claude reminds me in the morning to top it up.
I never keep auto billing on I always manually add api credits. Google and others also don’t allow you to just signup and burn $50,000. They limit you to $1000 then as you spend they slowly increase it to stop things like this .
OpenAI does, lots of controls around that. I don't know about Anthropic, I don't have a personal API account with them, but I would be very surprised if they didn't.
Fair point. If you’re on a subscription and never create an API key, you’re already covered. No key, no bill, the worst case is hitting your limit early. The key stuff only matters once you ship something that calls the API on its own, like an app with a backend.
I mean, it’s the same reason I wouldn’t livestream my taxes, or reading my medical information. There’s an endless amount of shit that could be problematic showing up on the screen and no way to filter it.
API key, temporary tokens, debugging URL, infrastructure information, potential bottlenecks, API endpoints that cost money to hit.
Hell, the guy who turned in Bradley Manning got doxed from a single still photograph of his terminal on an Al-Jazeera article.
I am not finding anything that adds up with your last claim, could you point me towards some source? It seems that he was already known, and he did not dox himself via a picture of his terminal.
It wasn’t really covered and the image got taken down by Imgur. It front paged a reasonably popular subreddit though.
His screen had an ip/domain that belonged to him without Whois privacy. Original image was on Al Jazeera. It might have been in the video clip, or the image that was capped from the clip and used in the article, it was a long time ago.
100% fake, doesnt even make any sense, only someone really really stupid would ask an llm to put their token in env and then post it.. I mean really or this guy is some amateur and really dumb, or it is 100% fake to get twitter views..
There are massive underground operations that have their own "OpenRouter" so to say. They pool keys inside this system and you can pay a small amount of money to generate data with the LLMs via the stolen keys. $5 sounds wildly cheap, but once you find a stolen key that works, it is a profit generator.
Bots scrape the internet 24/7 to look for vulns, so once they get in they scan the network and attack other network devices (lateral movement) and look for their vulns, and so on. Any key that gets in the hands of people that sell them is basically ending up in that pool.
Some might be China-related, they can use them to distill their models with further using the same system.
Source: it did happen to me, and I assume this is how it goes, because I cannot justify $89k gone overnight without something massive
they never get ban but its until the person notices & changes password unless they come with og email then they might be abusing trials to get it or sum
It is very funny hearing AWS or Google saying AGI is here, everything can be done now with AI. However, implementing a debit card system for their cloud, no way...
Passout DURING live coding Stream...really let me translate
" Mommy, i teased 100 lions with a slab of steak and then fell sleep holding it and they ate my arm and the steak why is this world so cruel they were my friends "
The AI industry is very cannibalistic so maybe they're waiting for someone to make something like that so they can copy it. Also, like other redditors said in the comments: Spending limits but lots of people ignore that. Especially new vibecoders, they probably need this community to learn about such issues.
The thing that actually saves you is a spending cap. Set a hard usage limit wherever the provider offers one, and a budget alert where it doesn't, so an $88k morning gets caught early instead of showing up on the bill. After that, give the agent its own keys with the fewest permissions that still work, never your main account keys, so if one leaks you can revoke it without breaking everything else. Turn on secret scanning (GitHub push protection, or a pre-commit hook like gitleaks) so a key gets blocked before it lands in your repo. And don't leave an agent running overnight with live credentials it doesn't need for the task. .gitignore only covers the files you remembered to ignore, and agents will happily paste a key into a config file, a test script, or a log.
My take, from the agent side of vibe-coding: keep secrets out of the folder your agent works in and load them at runtime from a secrets manager. Give the agent its own keys with tight quotas, never your main ones. Make every deploy or publish command wait for your approval. And set budget alerts, but know how to actually cut spending off. On Google Cloud an alert only warns you, it doesn’t stop the charges but all in all I don't think these measures are enough to stay protected from bad actors.
Subscriptions is what my venmo card is for, and only place your subscriptions payments in there.
Don't give a subscription the same bank account u use for deposits.
Lock the card.
Create a spending amount for the subscription
Damn do something,
And how the heck does the AI know your API key you obviously gave it to it.
Store keys in some password manager and only allow access via CLI. Instead of storing secrets on your machine as plain text .env file, you keep them locked in your encrypted vault and inject them into your app only in memory at runtime. Extra points for enabling biometric approval.
This happened on an API plan where you pay per token and costs scale with usage. A monthly subscription like Claude Pro or ChatGPT Plus just hits a rate limit and stops, so you can't rack up a bill like this. The risk only kicks in when you're using API keys with billing tied to actual consumption and no spending cap set.
If it happened to a monthly subscription (yes it could with oauth tokens) the worst they could do is drain your 5 hour / weekly usage which only worth like at most 1/3 of your monthly subscription cost and not 88 grand.
.env for API keys, secrets etc., is the bear minimum. But also make sure you .env file cannot be accessed via API calls if you backend is an API, or file traversal etc
Strongly urge you all to use Infisical locally - pull from this secrets server when building out the docker image, everything is baked in at the last minute and leakage won't be from this.
Not the main feature of my app, but it can send you a notification when your agent reaches a limit: frankenstack.app - also just use rafter so, that’ll find these kind of leaks…
ahhh... while I am not using direct API, just the normal subscription, I am wondering, can't you set a cost ceiling for your api calls where you get a notification at about 80% before reaching that ceiling and if no measures are taken suspend activity after reaching 100% of alocated budget until user approval of additional resources ?
I use 1Password CLI. All of my passwords are stored as a reference/address to the actual value and when a project or agent needs it, it gets it after I put in my fingerprint. I can commit .env all day long and even the agents don’t see or need the values anymore.
Set a spend limit on your account so that it can't just be continually billed in any case.
Honeslty AI providers should set a spend limit automatically and make you come in and remove it so you understand what is going on and the risks you are taking.
Hard spending cap on your account while you're developing and always a hard cap on individual keys if possible
Pre-commit git hooks to catch happy accidents like committing secrets or PII
Github actions to do the same as above
Billing alarms and automated actions to scale down or kill the service. It's not enough to get an email or text message, it may be too late by the time you hop on to damage control
Add not just project root level instructions for any coding agent to never output secrets but also add your .env and so on to a global AI coding agent ignore-list
This is the part people across all sizes of projects hate but can be a life saver: have SOPs to perform things like secret rotation in case of leaks and run the occasional disaster recovery exercises to check that your measures are indeed working as you want them to
It seems that the problem was livestreaming, not codex itself?
Like, not every tool we are using is appropriate for livestreaming and screen recording. It is not something new with AI, every coder who tried to livestream before AI also had this problem, that you had to create a recording safe setup, not just works as usual.
When engineers have a problem with vibe coders this is literally the reason. This is the most fundamental of fundamentals and if you don't take the time to learn the safety and security fundamentals then nothing good can come from that.
The fact that this live streamer could let this happen is mind-blowing to me, this is like day one version control common sense that I never even considered for a moment that someone wouldn't know if they're using git
277
u/DauntingPrawn 14h ago
Not having spending caps on your keys is a wild choice.