Your Gemini API Key Isn’t Safe in the Browser — Here’s What Actually Stops the Bill
Open the dev tools in any browser, click the Network tab, and load a page that calls an AI feature directly from client code. If the developer embedded an API key to make that call, it is sitting right there in plain text — no hacking required, just a right-click. For years this kind of mistake was mostly an embarrassment. With Gemini, it can now show up on an invoice.