@shawmakesmagic: Got a $2,433.37 Together AI bill from a leaked key after Railwa

Submit
@shawmakesmagic
@shawmakesmagic

Just got a bill from @togethercompute for $2,433.37 I had used them in a project I had on @Railway last year, had been $0.00 billed since then, apparently my API key was compromised in the Railway hack and used to run DeepSeek and GLM-5.3 I deleted everything off Railway when we were notified of the hack so it's not like I could go through and track down every single secret It's pretty crazy that as a developer I have to be responsible for 100+ services and APIs which are then plugged into dozens of other services and whenever those are compromised I have to track down every single one. They say "rotate your keys" but what happens when you completely forget that the keys exist or that they are in an old project? IDK man this really sucks

securityx.com

@shawmakesmagic: Got a $2,433.37 Together AI bill from a leaked key after Railwa

submitted bytim12,5752h
Read original article
AI summary of the linked article

A developer says Together AI billed them $2,433.37 after an API key from an old project on Railway was apparently compromised in the Railway hack and used to run DeepSeek and GLM-5.3. The developer, who is @shawmakesmagic, had used Together AI in that project the previous year and had shown $0.00 billed since then. They say they deleted everything on Railway when notified of the hack, but could not track down every secret, and argue that a developer can be responsible for over 100 services and APIs whose compromise requires tracking each one down. They ask what happens when people forget that old keys exist.

Comments
No comments yetWhat caught your eye? Start the discussion.
Top stories that week →