Founder of CloudSentinel — automatic API key revocation for GCP.
GCP has no native kill switch for compromised API keys. Budget alerts lag 4-12 hours. By the time they fire, the damage is already done.
CloudSentinel polls raw request counts via GCP Cloud Monitoring every minute and revokes the key automatically when a threshold is crossed. No human in the loop. Confirmed working in production.
cloudsentinel.dev — 14-day free trial, no credit card.
Submissions
[untitled]
1 points·by daudmalik06··0 comments
[untitled]
1 points·by daudmalik06··0 comments
[untitled]
1 points·by daudmalik06··0 comments
Ask HN: Is there any founder building non AI startup in 2026?
13 points·by daudmalik06··9 comments
[untitled]
1 points·by daudmalik06··0 comments
[untitled]
1 points·by daudmalik06··0 comments
Tell HN: A company was billed $128K from one leaked GCP API key
8 points·by daudmalik06··3 comments
$82K GCP bill in 48 hours – so I built an automatic API key kill switch
cloudsentinel.dev
1 points·by daudmalik06··1 comments
[untitled]
1 points·by daudmalik06··0 comments
[untitled]
1 points·by daudmalik06··0 comments
Show HN: Open-Source Security Monitoring with AI and License Compliance
1 points·by daudmalik06··1 comments
Attention: RCE Vulnerability Discovered in Laravel
1 points·by daudmalik06··0 comments
Ask HN: We're tired and need your support
5 points·by daudmalik06··2 comments
Show HN: Compliant SBOM Management per US Senate Directive
2 points·by daudmalik06··0 comments
Show HN: Investment opportunity in a cyber security startup
1 points·by daudmalik06··0 comments
[untitled]
3 points·by daudmalik06··0 comments
[untitled]
1 points·by daudmalik06··0 comments
[untitled]
1 points·by daudmalik06··0 comments
Show HN: A Revamped Vulnerability Database – Rapid and Detailed Reports
1 points·by daudmalik06··1 comments
Show HN: Vulnerable dependencies in a NPM package with 840k weekly downloads
The approaches make sense for teams with engineering resources to build internal tooling. The LLM gateway layer is smart — virtual keys with caps is exactly the right mental model. The hard part is most solo devs and small teams never get around to building that layer, which is where the incidents happen. We built CloudSentinel specifically for that gap — automatic revocation on raw request count, no internal tooling required. Happy to share more if useful.
After reading about a 3-person startup that received an $82,000 Gemini
API bill in 48 hours (normal monthly spend: $180), I started building
CloudSentinel.
The core problem: GCP has no native kill switch. Budget alerts send an
email. Quota limits throttle requests. Neither revokes a key
automatically. And billing data is delayed by hours — useless for
real-time protection.
The architecture:
CloudSentinel monitors raw API request count — updated in near
real-time. We create an Alerting Policy inside the user's own GCP
project using MQL. When the request threshold is crossed, Google fires
a Pub/Sub webhook to CloudSentinel. We receive it and revoke that exact
key automatically.
The security decision I'm most proud of:
Revoke-Only IAM model. The Custom IAM Role has three responsibilities:
- Read API key IDs and metadata (never key values)
- Create monitoring rules inside the user's project
- Revoke a specific key when a threshold is crossed
The permission apikeys.create is not in the role. Not restricted —
absent. Even if CloudSentinel is fully compromised, an attacker can
only remove access, never create keys or touch anything else.
This is why we at vulert.com never access the customer's codebase or any installation, who doesn't know vulert, it's a service that notifies you for security issues in your software dependencies.
Well, actually we track all of the CVE lists, security advisories of vendors, package managers and as soon as there's an issue related to the software you use, we notify you.
That's it.
Yeah, you can just upload a composer.lock file and that's it,
we will track all of the open source you use and even the software that comes under first level. I.e we track the complete graph.
GCP has no native kill switch for compromised API keys. Budget alerts lag 4-12 hours. By the time they fire, the damage is already done.
CloudSentinel polls raw request counts via GCP Cloud Monitoring every minute and revokes the key automatically when a threshold is crossed. No human in the loop. Confirmed working in production.
cloudsentinel.dev — 14-day free trial, no credit card.