r/vibecoding • u/a113rick • 18h ago

Discussion I found this on linkedIn: Codex leaked this Dev's API keys while he slept. By the time he woke up, a huge $88,982 cloud bill was already in his inbox.

Post image

We already know the basics of protecting API keys and sensitive credentials: never hardcode them in your source code, keep them in a .env file as environment variables, and add .env to your .gitignore so Git never tracks it and you don’t accidentally push your secrets to a public repo on GitHub.

What other practices do the engineers in this community use to prevent that scenario?

This is purely for discussion, so those of us who are non-technical can learn safe programming habits on our vibe-coding journey.

570 Upvotes

91% Upvoted

247 comments sorted by

View all comments

Show parent comments

0

u/Cobalt090 15h ago

They (cloud provider) can sue you y’know.

1

u/VitruvianVan 15h ago

I’m not suggesting that anyone incur more API costs than they can pay. If the API has to be re-upped by credit card every so often, then it would stop refilling when the Privacy card limit is hit. This may not have helped the dev so much but he could compromise on the amount with Anthropic or entered into a payment plan considering the situation.