Hackers Are Stealing API Keys. Google Just Suspended Mine.

My 4-step checklist for API keys

1. Put a hard dollar cap on every AI account. A stolen key at 2 AM should hit a limit, not your bank account.
2. Keep a one-page map of where every key lives. One key per app, never shared, so you can change one without breaking everything.
3. Ask whoever built your website or app: "Can anyone see my API key on the public site?" The key belongs on your server; the browser gets a short-lived pass (mine expires in 60 seconds).
4. Practice swapping a key before you need to. New key at the source first (Google, OpenAI, Stripe), then your server. Know which keys can't be swapped in one step.

Source: Railway's preliminary incident report https://blog.railway.com/p/preliminary-report-october-security-incident

All files for this video are in one folder on GitHub: 2026-10-26-stolen-api-keys.