Leaked / stolen credential
An API key was published (e.g. to GitHub) and abused. The fix is per-key caps and anomaly flagging on geographic or volume spikes, on top of key rotation.
How to stop it
Configure velocity + anomaly FLAG in sipi.bot. Every transaction matching this pattern is then BLOCKed or FLAGged before any money moves.
Per-transaction cap
A single runaway purchase, a fat-finger API call, or an attacker testing how much they can move at once.
max_amount_usd: 500Velocity limit
Infinite retry loops and credential-abuse bursts before the dollars pile up.
max_per_minute: 201 documented leaked credentials incident
| Incident | Loss | Provider | Year | Source |
|---|---|---|---|---|
| Leaked Gemini API key led to a $55,444.78 Google Cloud bill | $55,444.78 | Google (Gemini) | 2025 | r/googlecloud ↗ |
Close this gap in your agents
One rule covers every incident on this page. Set it once in sipi.bot and every matching transaction is evaluated in <5ms, before the money moves.