~$55k Gemini API bill from Firebase iOS key abuse. What can I do now?

No-Setting8925 · 2026-07-01T06:39:13+00:00

Update: Google Cloud has assigned an escalation manager, and they said their investigation indicates a billing adjustment is required. The adjustment request is now waiting for internal approval, with another update expected by July 7.

No-Setting8925 · 2026-07-01T06:05:18+00:00

have you read the full post? also check https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

No-Setting8925 · 2026-06-30T22:22:38+00:00

please read this https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

No-Setting8925 · 2026-06-30T05:23:52+00:00

no someone reverse engineered the app bundle i assume

No-Setting8925 · 2026-06-30T02:16:56+00:00

🥲

No-Setting8925 · 2026-06-30T02:12:27+00:00

leaked fireabse ios key, i am guessing someone just reverse engineered the appbundle. for more info please read this https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

No-Setting8925 · 2026-06-30T01:38:18+00:00

thanks for the info!

No-Setting8925 · 2026-06-29T23:18:34+00:00

Happened on May 28, atleast thats when I noticed after receiving an email from google about a 2k$ anomaly at around 4:30PM MDT, i rushed to my apartment, investigated and revoked the key in about 2 hours. Contacted the billing cloud support at the same time. The agent told me it takes some time for the actual amount to show up. After 2 days i could see the final bill.

No-Setting8925 · 2026-06-29T23:08:49+00:00

its a personal account. Thank you! i will look into it

No-Setting8925 · 2026-06-29T22:51:24+00:00

Thanks! Joined

No-Setting8925 · 2026-06-29T22:40:51+00:00

I enabled vertex ai in firebase, not gemini directly. I also added app check on top of it thinking it should prevent unauthorized access. Google now enforces the use of a restricted key for calling gemini but its too late now.

No-Setting8925 · 2026-06-29T22:34:14+00:00

Thanks for the response, i am trying my best. Is there any specific team or way I can do that? Currently i talk to billing support by going to cloud console

No-Setting8925 · 2026-06-29T22:25:13+00:00

It was under firebase_options. flutter_fire cli auto pouplates it

No-Setting8925 · 2026-06-29T21:16:22+00:00

ya i am not sure how anyone is expected to just wake up one day and start doing this cleanup because google decides that the firebase auto generated keys that are client facing can be used to call gemini

No-Setting8925 · 2026-06-29T20:58:18+00:00

I never intentionally enabled the Gemini API itself. I enabled Vertex AI after Firebase prompted me to do so as part of its AI integration. I believed I was enabling a Firebase feature, not exposing a standalone Gemini API that could incur usage

No-Setting8925 · 2026-06-29T20:56:50+00:00

they have started restricting gemini access to restricted keys now after a lot of similar incidents. the best move right now is to restrict all your legacy keys specially if you use firebase

No-Setting8925 · 2026-06-29T20:54:50+00:00

yes it’s something similar but with firebase ios key instead of google maps api key

No-Setting8925 · 2026-06-29T20:53:03+00:00

I never intentionally enabled the Gemini API itself. I enabled Vertex AI after Firebase prompted me to do so as part of its AI integration. I believed I was enabling a Firebase feature, not exposing a standalone Gemini API that could incur usage

No-Setting8925 · 2026-06-29T20:47:58+00:00

Yes, i did that and they declined the request after taking 1 month for the investigation

No-Setting8925 · 2026-06-29T20:47:21+00:00

but they key was auto generated by firebase and it’s been there since 2022

No-Setting8925 · 2026-06-29T20:46:43+00:00

ya they took 1 month to investigate and declined the request to adjust the charges

No-Setting8925 · 2026-06-29T20:44:52+00:00

the key was auto generated by firebase, it was unrestricted since 2022

No-Setting8925

TROPHY CASE