Dev's Codex deployed his .env to Cloudflare Pages, landing a $90,000 Google API bill
ssh4net · x · 2026-10-22
A viral drama thread: the PHP Foundation pre-announced an emergency security release for Oct 21 fixing two critical CVSSv4 9.2 vulnerabilities. When a commenter mocked "real devs don't use PHP," others dug up that he had just self-reported a key leak: after asking Claude Opus 5.5 to investigate, he found Codex had published his .env file to Cloudflare Pages, leaking his Google API keys and landing him a $90,000 bill.
Takeaway for developers: when letting coding agents handle deployments, exclude secret files and audit deploy artifacts — one push can expose all your credentials.
Related event: Developer's AI Coding Assistant Leaks .env, Costing $90K in Google Bills(3 posts)→
More from Fun
- Google's AI Overview answers 'Abstract Nonsense' with a curious [0.1] citation — kalomaze · 2026-10-22
- Blogger with 234K followers: AI complainers are 'imposter nerds' — kevinnbass · 2026-10-22
- HyperFrames generates a full 9.5-min finance explainer video on Thailand's economy — sven_ai · 2026-10-22
- 'Software is solved': dev mocks AI security coverage as fabricated media hype — gnukeith · 2026-10-22
- Frontier models spark a comeback of quirky game-style personal homepages — HamelHusain · 2026-10-22
- 'Long Short-Term Memory' pun strikes a chord: how many people are LSTM? — willcb · 2026-10-22