On a Friday evening in March 2020, a small startup called Milkie Way deployed a test. They were building a product called Announce on Google Cloud, using Firebase and Cloud Run, and they'd set a billing budget of $7.
The next morning, founder Sudeep Chauhan saw a bill of about $5,000. Within a couple of hours it had settled at a little under $72,000. A piece of code that followed links between pages had ended up in a loop, and it kept calling the database, billions of times, while everyone slept.
The $7 budget didn't stop any of it. Google's own documentation says a billing budget does not automatically cap usage or spending. It sends an alert. By the time anyone reads the alert, the money is spent. Google eventually waived the bill as a one-time gesture, after Chauhan sent them a detailed write-up of the incident.
It doesn't need a bug, either
Milkie Way's bill came from their own code. The same thing can come from other people.
In February 2024, a developer posted on Hacker News that Netlify had billed them $104,000 for a simple static site. Bandwidth had spiked for four days, peaking at 60.7 terabytes on a single day. It turned out to be sustained downloading of an audio file hosted on the site. Netlify first reduced the bill to about $5,000, and after the post went viral, waived it entirely.
Both stories ended well because they became public. Plenty of similar ones don't, and you can't plan on a refund.
Why AI features make this more likely
Most AI-built apps now include at least one feature that calls a paid model: summarise this, generate that, chat with your documents. Each call costs money. So does sending an SMS code, an email, or generating an image.
If the route that triggers one of those calls can be reached without logging in, or can be called as often as someone likes, then anyone who finds it can spend your money. Sometimes they want free access to a model. Sometimes they're just curious. The founder in our story about the SaaS attacked two days after launch reported "maxed out usage on api keys" as the first symptom.
Security people call this "denial of wallet". Nothing is stolen and nothing goes down. You just pay.
How to put a ceiling on it
Require login for anything that costs money
The first question for every paid feature: can someone use it without an account? If yes, and it isn't meant to be a free public demo, put it behind login. Free accounts are cheap to create, so this alone isn't enough, but it removes anonymous scripts.
Rate-limit per user
Decide how many times a reasonable user would use a feature in a minute, an hour and a day, then enforce a limit a bit above that on the server. Twenty AI requests a minute is generous for a human and a hard wall for a script. Many hosting platforms and backends have rate-limiting built in, and your AI coding tool can add it:
Add server-side rate limiting to every route that calls a paid external API (AI models, email, SMS). Limit per signed-in user and per IP address. Return HTTP 429 when exceeded. List every route you changed and the limits you chose.
Set hard caps with providers, not just alerts
Most AI providers let you set a monthly spending limit or use prepaid credits that simply run out. Use them. For cloud platforms, check whether a real cap exists. Where it doesn't, alerts are still worth having, just don't mistake them for a limit.
Watch for loops in your own code
Milkie Way's bill came from their own recursion. Before deploying anything that calls itself, triggers other functions, or crawls, ask your AI tool to explain how it stops. Set a maximum on retries and on instances.
Keep keys off the frontend
If the key for a paid service is in your website's code, none of the above matters: someone can use it directly, from anywhere. Here's how to check for exposed keys in five minutes.
A five-minute audit
List every feature in your app that costs you money per use. For each one, write down whether it requires login, whether it has a rate limit, and where the key lives. Any line with "no", "no", "frontend" is where your next surprise invoice comes from. The "Cost and abuse" section of our pre-launch checklist covers the rest.