How does FireShield know my bill is spiking?

Google reports each project's spend to FireShield through its budget notifications. The moment a report arrives, FireShield checks it against your thresholds and runs their actions; nobody has to read an email first. How often and how soon Google reports is up to Google.

What does it actually do when a threshold is crossed?

Whatever you set for that threshold. Every budget starts with a Hard Kill at 100% (disconnecting the project's GCP billing account so spend stops), which you can move or remove. On any threshold you can add alerts (email, Slack, Telegram) and, if you want it, a Soft Kill: a signed webhook to your own infrastructure asking it to degrade service.

Do I need to change my application code?

No. You link your project by signing in with Google, which grants FireShield an IAM role on its billing account. Nothing to install. Your code only changes if you choose to use Soft Kills: then you add one endpoint to receive the webhook. FireShield never touches your running services directly.

Can FireShield read my source code or infrastructure secrets?

No. Onboarding is zero-secrets: it uses IAM role grants, not uploaded credentials.

What's the difference between Starter, Pro and Enterprise?

All three protect your projects the same way: unlimited thresholds, email alerts, Soft Kill and Hard Kill. Starter covers one project. Pro covers up to 5 projects and adds Slack and Telegram alerts, per-project spend charts, a spend breakdown by service, and usage spike detection checked every 10 minutes. Enterprise has everything in Pro, with no limit on projects and spike checks every 5 minutes.

Does FireShield work with Firebase projects?

Yes. Firebase runs on Google Cloud, so any Firebase project on the pay-as-you-go Blaze plan is a GCP project FireShield can protect. If you've ever hit a surprise Firebase usage limit or a Blaze plan bill that got out of hand, that's exactly the scenario FireShield exists to stop.

What is usage spike detection?

Google reports spend with a delay of 15 minutes to several hours, so a runaway can grow before any budget alert fires. On Pro and Enterprise, FireShield also reads the usage of each service (Firestore, Cloud Functions, Storage, Realtime Database, Hosting, Gemini) and compares the last hour with the same hour over the last 7 days. When a service jumps past the multiplier you set, say 10 times its normal level, it runs the actions you chose: an alert, a Soft Kill or a Hard Kill. It measures usage, not cost, and you turn it on per project, which grants FireShield read-only access to that project's usage metrics.

← All horror stories

Bill horror story

$82,314 in 48 hours: a public Maps key that could call Gemini

October 21, 2026 · 3 min read

A startup spending $180 a month enabled Gemini on a project whose browser key was public. Two days later the bill was over $82,000.

Retold from The Register, by Jessica Lyons, March 3, 2026. Summary in our own words; every figure is the source's.

What happened

A three-person startup in Mexico usually spent about $180 a month on Google Cloud. Its API key had been embedded in website code to use a Maps service, which is normal for browser keys. Then a teammate enabled the Gemini API on the same project, and that public key could suddenly call Gemini as well.

The key was abused on February 11 and 12, 2026, and about $82,314.44 in Gemini charges built up in roughly 48 hours. The developer, as quoted by The Register from their Reddit post: "I am in a state of shock and panic right now". Security firm Truffle Security found 2,863 live keys exposed in the same way.

How it ended

The developer deleted the key, disabled Gemini and rotated credentials. Google support pointed to the shared responsibility model and said the charges stood. No refund was reported.

What would have stopped it

Restricting the key. A browser key restricted to the Maps APIs it needs can't call Gemini, whatever else is enabled on the project.
A quota on the expensive API. A per-day request quota on the Gemini API bounds what a stolen key can spend (how to set limits).
Spike detection from zero. A service that had no usage at all and suddenly has thousands of requests is the clearest possible anomaly. Watching Gemini usage would have flagged it within minutes, and an automatic action could have stopped it on the first day instead of the third.