Blog
How Firebase and Google Cloud billing really works, and how to keep a bug or an attack from turning into a five-figure bill.
October 21, 2026 · 5 min read
Why Firebase budget alerts don't stop your bill
A Firebase or Google Cloud budget only sends alerts, and they arrive hours late. What Google's docs say, and what actually stops the spend.
October 21, 2026 · 6 min read
How to limit Firebase spending on the Blaze plan
There is no project-wide spending limit on Blaze. The six limits you can stack instead, from budget thresholds to max instances, API quotas and an automatic kill switch.
October 21, 2026 · 7 min read
Build a Firebase kill switch: disable billing automatically
Step by step: a Cloud Function on your budget's Pub/Sub topic that disconnects billing past your limit, with the code, the IAM role it needs and where it falls short.
October 21, 2026 · 5 min read
What happens when you disable billing on a Firebase project
Which services stop, whether your data is deleted, what you still pay and how to bring the project back, from Google's and Firebase's own docs.
October 21, 2026 · 5 min read
Denial of wallet: how attacks run up your Firebase bill
On a pay-per-use backend an attack doesn't take your app down, it makes it expensive. Why Firebase apps are exposed and how to shrink the risk.
October 21, 2026 · 4 min read
Soft Kill: degrade gracefully before the bill does
Instead of switching the whole project off, let your app turn off its expensive parts when spend crosses a threshold. What to degrade and how to wire it.
Bill horror stories
See all →Real runaway bills other developers published, retold with credit, and what would have stopped each one.
$72,000 in two hours: the Cloud Run and Firestore test that ran away
A scraper bug, Cloud Run's scaling and a $7 budget that only alerted: how a startup's overnight test turned into a bill just under $72,000.
$30,356 in 72 hours: one line that read a whole Firestore collection
A viral campaign and a page that loaded every payment on each visit: billions of Firestore reads before anyone noticed.
$82,314 in 48 hours: a public Maps key that could call Gemini
A startup spending $180 a month enabled Gemini on a project whose browser key was public. Two days later the bill was over $82,000.
