After Mandiant’s LLMjacking report (stolen keys running up $100K+ a day), I went back over my own AI keys. Here’s the checklist I use. It works for OpenAI, Anthropic, SpaceXSI, Google and most others.
1. One key per job
Give every bot, app and script its own key. If one leaks, you revoke one key, not all of them. Name each key after what uses it so you can see right away which one is burning tokens.
2. Set a hard limit and an alert
Most provider consoles let you set a monthly spending limit or budget plus an email alert. Set the alert around 50% of what you normally spend and the hard cap a little above it. On Google Cloud, set a budget with alerts on the project too. Budgets alone don’t stop spend, so watch the alerts.
3. Kill old keys and service account keys
Delete any key you haven’t used in 30 days. On Google Cloud, list them with:
gcloud iam service-accounts keys list --iam-account=SA_EMAIL --managed-by=userA misconfigured service account key is how one of Mandiant’s cases started.
4. Scan for leaked keys
Run gitleaks over your repos and dotfiles before you push:
gitleaks detect --source . --redact5. Never paste a token into a web page
One crew used a fake “join our group” page to get people to paste live tokens. No real service asks you to do that.
For more, see my token budget how-to.
God Bless, and Happy hacking!
