# @shawmakesmagic: Got a $2,433.37 Together AI bill from a leaked key after Railwa

Source: https://x.com/shawmakesmagic/status/2117206748641816887
Kiwi News: https://news.kiwistand.com/stories/shawmakesmagic-Got-a-dollar243337-Together-AI-bill-from-a-leaked-key-after-Railwa?index=0x6ae8fe26f47fde2cb1ff4c1a3fd4523929614defafa325a6aa2842b80d2b223769ead2e2
Submitted by tim on 2026-11-02 UTC, 1 upvote, 0 comments

## Summary

A developer says Together AI billed them $2,433.37 after an API key from an old project on Railway was apparently compromised in the Railway hack and used to run DeepSeek and GLM-5.3. The developer, who is @shawmakesmagic, had used Together AI in that project the previous year and had shown $0.00 billed since then. They say they deleted everything on Railway when notified of the hack, but could not track down every secret, and argue that a developer can be responsible for over 100 services and APIs whose compromise requires tracking each one down. They ask what happens when people forget that old keys exist.

## Article

Just got a bill from @togethercompute for $2,433.37

I had used them in a project I had on @Railway last year, had been $0.00 billed since then, apparently my API key was compromised in the Railway hack and used to run DeepSeek and GLM-5.3

I deleted everything off Railway when we were notified of the hack so it's not like I could go through and track down every single secret

It's pretty crazy that as a developer I have to be responsible for 100+ services and APIs which are then plugged into dozens of other services and whenever those are compromised I have to track down every single one.

They say "rotate your keys" but what happens when you completely forget that the keys exist or that they are in an old project?

IDK man this really sucks