Will this stop my bill right now?

The checklist walks you through the caps and key changes each provider offers. Every cap has a delay, and the provider's console is where the change happens.

Does the scanner catch every leaked key?

No. It's pattern-based, so split, encoded, or new-format keys are missed, including Google's newer Gemini authorization keys, which have no published format.

Will the provider refund the charges?

We can't say. The template is a request, and no provider promises a waiver or refund.

Node 20 or later for the scanner. The checklist and template are plain Markdown.

Is this legal or financial advice?

No. The checklist and template are general information.

Do updates cost extra?

Free updates within 1.x. Single-user commercial licence.

API Bill Panic Kit · OpenAI, Anthropic, Google AI

Your AI API bill is climbing. Here’s what to do, in order.

Name: API Bill Panic Kit
Brand: Stack & Ship
Price: 9 USD
Availability: InStock

A sourced, step-by-step checklist for when an AI API bill is climbing, a leaked-key scanner you run in one command, and a neutral template for asking a provider to review the bill. No install, no account, and no monthly fee.

$9 (plus VAT where applicable)

Get API Bill Panic Kit

API Bill Panic Kit cover: a scan finds 2 masked keys; npm test 14 pass, 1 skipped (gitleaks not installed); checklist steps.

What’s inside

Panic checklist for OpenAI, Anthropic, and Google (Gemini API and Vertex/Cloud): limit the spend now, revoke or rotate keys on each console, clean the leak out of code and builds, set limits before launch, then ask about the bill. It covers gaps that catch people out:
- Google Cloud budgets only alert. The checklist sets out the options (Gemini project spend caps, API quotas, disabling billing, and spend cap budgets where supported) and what each one costs you.
- Every cap has a delay. As of October 2026, OpenAI's docs say recorded spend "can slightly exceed" a hard limit, and Gemini project caps allow overages for around 10 minutes.
- Anthropic's Default Workspace can't take a spend limit, so the checklist moves production keys to their own workspace.
Evidence file: the official page and a quote behind every console step, read 24 Oct 2026. Steps we couldn't confirm are marked unverified.
scan-keys.mjs: a Node script with no dependencies, designed to find OpenAI, Anthropic, and Google key patterns in git history (every local branch and tag, including keys deleted in later commits), the working tree, and built bundles (dist/, build/, out/, .next/static, and source maps). It prints masked values only, with the file, line, and commit. It can also run gitleaks if you have it installed.
Bill review request template: neutral wording and a timeline to fill in. It's a request: no provider promises a waiver or refund.
Bonus: a git pre-commit hook designed to refuse commits that add a key, and an example .gitleaks.toml.

Who it’s for

Developers who just saw an unexpected OpenAI, Anthropic, or Gemini API bill, or got a "key leaked" warning.
Builders shipping AI features from scripts, notebooks, or front-end apps who want limits and a key scan in place before launch.

How it works

Download and unzip. The checklist and template are plain Markdown.
Work down the checklist: limit spend first, then rotate keys, then find the leak.
Run node scripts/scan-keys.mjs in your repo (Node 20 or later) to look for key patterns in history, files, and builds.
Fill in the bill review template if you want to ask the provider to look at the charges.

Tested

15 automated tests on Node 20.19 and Node 24.22 on Linux. With gitleaks installed, all 15 pass; without it, 14 pass and 1 is skipped. They use fixture repos and bundles with planted fake keys and clean cases, and check that full keys don't appear in the output.
Not tested on Windows or macOS, and not tested against live provider accounts: console steps come from the official docs.

FAQ

Will this stop my bill right now?: The checklist walks you through the caps and key changes each provider offers. Every cap has a delay, and the provider's console is where the change happens.
Does the scanner catch every leaked key?: No. It's pattern-based, so split, encoded, or new-format keys are missed, including Google's newer Gemini authorization keys, which have no published format.
Will the provider refund the charges?: We can't say. The template is a request, and no provider promises a waiver or refund.
What do I need?: Node 20 or later for the scanner. The checklist and template are plain Markdown.
Is this legal or financial advice?: No. The checklist and template are general information.
Do updates cost extra?: Free updates within 1.x. Single-user commercial licence.

Get the kit

Disclosure: this is our own paid product.

API Bill Panic Kit: $9 (plus VAT where applicable)

Get API Bill Panic Kit

Digital download: by buying, you ask for immediate access and agree that your 14-day right to cancel ends once the download or access starts. We also offer a voluntary refund within 14 days of purchase if it didn't help: just reply to your receipt email. This doesn't affect your legal rights if the content is faulty.

We may email buyers about similar products. Every email has an unsubscribe link, or reply to opt out.

Anthropic and Claude are trademarks of Anthropic. OpenAI is a trademark of OpenAI. Google, Gemini, Google Cloud, Vertex AI, and Google AI Studio are trademarks of Google LLC. Next.js is a trademark of Vercel, Inc. Node.js is a trademark of the OpenJS Foundation. Git is a trademark of Software Freedom Conservancy. Other product names, including Gitleaks, Windows, macOS, and Linux, are trademarks of their respective owners. Names are used only to identify products and compatibility. Stack & Ship is not affiliated with or endorsed by any of them.