You built something with AI. It works, your team likes it, and you moved on to the next job. Then, weeks later, an invoice arrives from a cloud provider and the number on it makes your stomach drop.
This is more common than most people admit, and it rarely involves anyone doing something reckless. It usually starts with one small, ordinary mistake that nobody noticed.
If you are not a developer, the honest answer to “could something I built run up a bill I don’t know about?” is yes. Here is how it happens, and what you can do about it.
How a Small Slip Becomes a Five-Figure Invoice
Modern apps talk to other services using secrets: passwords, keys and tokens that prove the app is allowed to use a paid service. If one of those secrets ends up somewhere public, such as a code repository accidentally set to public, anyone who finds it can use your account as if they were you.
Automated tools scan public code constantly, looking for exactly this. They do not need to know who you are. They find a key, use it to spin up expensive computing power, and the meter runs in your name. We have seen a single exposed secret lead to a five-figure cloud bill, and the first anyone knew about it was the invoice.
Nothing in that chain requires the person who built the app to have done anything dramatic. It is a quiet accident followed by a very loud bill.
Why Non-Developers Are Most Exposed
A technology lead we spoke to recently summed up the underlying problem in one line:
“You don’t know what you don’t know.”
That is not a criticism. If you built your app with an AI assistant, it will have made hundreds of small decisions for you: where to store passwords, which services to connect, who can see the code. Most of them will be fine. A few might not be, and you have no easy way to tell which.
The same worry showed up in a very different business. The owner of a care provider explained why a finished tool was not yet in full use:
“I’m almost scared to roll it out properly just in case something goes wrong.”
That caution is sensible. When you cannot see inside what you have built, holding back feels safer than going live. The trouble is that the risk does not wait for your rollout. A leaked secret can be exploited whether or not anyone is using the app.
Five Questions Anyone Can Ask
You do not need to read code to get a grip on this. You need to ask the right questions of whoever built or maintains your app, and expect plain answers.
First, ask whether anyone has checked your code for exposed secrets, and whether that check runs automatically every time something changes. Second, ask whether your repository is private, and who has access to it. Third, ask whether spending alerts are switched on with your cloud provider, so that an unusual jump in cost reaches a human within hours rather than at the end of the month. Fourth, ask whether each key can only do the job it needs, so that a leaked one cannot be used to run up costs elsewhere. Fifth, ask where all of those answers are written down.
None of these checks is exotic. Together they turn an invisible risk into a visible one, and visibility is most of the battle.
What to Do If You Think You Have Already Been Exposed
Do not wait for proof. Ask your developer or provider to revoke and replace any key that may have been public, then review your cloud account’s recent usage for anything you do not recognise. Set a spending alert while you are there. These steps take minutes, and they close the door even if nobody has walked through it yet.
Then work out how the secret got there in the first place, so the same slip cannot happen again.
Not Sure Where Your Hidden Risks Stand?
If you have built something with AI and cannot say for certain what it exposes or what it could cost you, our free 45 minute Operational Audit is a good place to start. We look at what you have, where the gaps are and what to fix first, in plain English and with no obligation.
Book yours at greengorillaautomation.co.uk.
