About

This site exists because of one incident.

In February 2026, a three-person startup in Mexico was billed $82,314 in 48 hours after an API key leaked. Their normal monthly spend was $180. They deleted the key, rotated credentials, and filed a support ticket. The charges stood.

What struck us wasn’t the leak — keys leak constantly. It was that an 8,000% overnight jump in usage went through unchallenged. The provider had the data. The provider had the fraud controls. Nothing happened until the bill arrived.

What we’re doing about it

We’re building a hard spending cap for AI APIs: a circuit breaker that cuts off abnormal usage automatically, rather than emailing you about it while it continues.

We’re not there yet. Right now this site does two things:

• The calculator — so you can see the magnitude of your own exposure, based on the real incident
• The writing — practical guides on prevention and incident response, drawn from documented cases rather than general advice

How we source things

Every number on this site comes from a publicly reported incident or a named survey. When we’re estimating rather than reporting, we say so — the provider multipliers in the calculator other than Gemini are estimates, and the calculator itself is a risk estimate, not a prediction.

If you find something wrong, tell us. Being corrected is cheaper than being wrong.

Get in touch

Use the form on the home page to join the list, or reply to any email we send.