Fixes · Security holes

Anyone can run up your OpenAI bill

An AI endpoint with no sign-in and no rate limit can be called in a loop by a bot or one curious person, and your AI provider bills you for every request.

Most common in apps built with Lovable, Bolt, v0.

What you see

Your AI provider's usage spikes overnight, or a route like /api/chat answers anyone who calls it, as fast as they call.

Why it happens

The route that calls the model checks neither who's asking nor how often. Scripts find routes like that within days.

How to fix it

  1. Require sign-in for anything that costs money.
  2. Limit requests per user or per IP, for example with @upstash/ratelimit and Redis.
  3. Set a monthly spending cap in the AI provider's dashboard.

Or ask your AI tool to fix it

Paste this into Lovable, Bolt, v0, Replit or Cursor, and let it make the change.

Add a rate limit to every API route that calls an AI model: per signed-in user, or per IP for anonymous use (for example @upstash/ratelimit with Upstash Redis), and require sign-in where the feature allows it. Return a clear 429 when the limit is reached.

Don't change what the app does.
Never put a secret key or password in the code: read it from an environment variable.
If a step has to be done outside the code, like revoking a key in a provider's dashboard, list it for me at the end instead of skipping it.

How Launchpad helps

The launch check lists each AI route without a limit. Launchpad can add an Upstash Redis for the limiter, and the console tracks this month's OpenAI and Anthropic spend with a budget alert.

Check your app for this, freeJoin the waitlist

Related