Unexpected costs
A stolen API key led to $1,700 in unauthorised AI usage.
In 2026, attackers compromised a coding tool and abused API keys stored in it. One developer reported $1,700 in unauthorised AI usage before the company announced the incident.
Why this happens: An API key lets your application access an external service, sometimes at your expense. If a secret key is exposed in code sent to a browser, someone else can copy it and use the service through your account.
Read the report (opens in a new tab)Could your website have the same problem?
Send us a link to your website. We’ll reply within two working days, explain what we recommend checking and agree a fixed price before work starts.