Abuse and cost

Cap your AI spend

Set provider spend limits and alerts, use one key per project, and cap max tokens per request so abuse can't drain your account.

Why it matters

A leaked or abused AI key is drained fast, and you pay for every token.

How to fix it

1. In the OpenAI and Anthropic consoles, set the spend limits and alerts they offer, and check whether each one blocks requests or only sends an email.
2. Use a separate key per project so you can revoke one without breaking others.
3. Set a maximum output token limit on every request in your code.
4. Limit input size before sending it to the model.

How to verify

• Check each console's limits page shows your values.
• Send an oversized request; your route should reject or truncate it.

Related checks

• Rate limit expensive and auth endpoints
• Set billing alerts on every paid service
• Rotate leaked keys, don't just delete them

Tick it off in the full checklist