daudmalik06

4 ay öncediscuss

does it support php codebase ? specifically laravel ?

daudmalik06

4 ay öncediscuss

interesting, a question will it download the code ? how does it work technically ?

daudmalik06

4 ay öncediscuss

[dead]

daudmalik06

4 ay öncediscuss

The approaches make sense for teams with engineering resources to build internal tooling. The LLM gateway layer is smart — virtual keys with caps is exactly the right mental model. The hard part is most solo devs and small teams never get around to building that layer, which is where the incidents happen. We built CloudSentinel specifically for that gap — automatic revocation on raw request count, no internal tooling required. Happy to share more if useful.

daudmalik06

5 ay öncediscuss

Original incident: https://www.reddit.com/r/googlecloud/s/3S1KWpWRZm

After reading about a 3-person startup that received an $82,000 Gemini API bill in 48 hours (normal monthly spend: $180), I started building CloudSentinel.

The core problem: GCP has no native kill switch. Budget alerts send an email. Quota limits throttle requests. Neither revokes a key automatically. And billing data is delayed by hours — useless for real-time protection.

The architecture:

CloudSentinel monitors raw API request count — updated in near real-time. We create an Alerting Policy inside the user's own GCP project using MQL. When the request threshold is crossed, Google fires a Pub/Sub webhook to CloudSentinel. We receive it and revoke that exact key automatically.

The security decision I'm most proud of:

Revoke-Only IAM model. The Custom IAM Role has three responsibilities: - Read API key IDs and metadata (never key values) - Create monitoring rules inside the user's project - Revoke a specific key when a threshold is crossed

The permission apikeys.create is not in the role. Not restricted — absent. Even if CloudSentinel is fully compromised, an attacker can only remove access, never create keys or touch anything else.

Early access open at https://cloudsentinel.dev

Have you ever dealt with a GCP billing surprise or a leaked key? Happy to hear your experience and discuss the architecture.

daudmalik06

3 yıl öncediscuss

really thanks for kind suggestions, it really means a lot. i will save your comment and will try to test and validate what you suggested.

thanks again mate.

daudmalik06

3 yıl öncediscuss

not a bad deal, perhaps :D

daudmalik06

3 yıl öncediscuss

you can also reach out to me at [email protected]

daudmalik06

3 yıl öncediscuss

Here's the link to our database: https://vulert.com/vuln-db/

please feel free to reach out at [email protected]

daudmalik06

3 yıl öncediscuss

feel free to reach out to me at [email protected]

daudmalik06

3 yıl öncediscuss

please feel free to reach out to me at [email protected]

daudmalik06

4 yıl öncediscuss

It's based on advisories, so, it also includes vulnerabilities that are not given yet a cve,

daudmalik06

4 yıl öncediscuss

This is why we at vulert.com never access the customer's codebase or any installation, who doesn't know vulert, it's a service that notifies you for security issues in your software dependencies.

daudmalik06

4 yıl öncediscuss

Yes, basically this tool is relying on github advisories, which is included in our list.

daudmalik06

4 yıl öncediscuss

Further, vulert is also 100% free for open source software.

daudmalik06

4 yıl öncediscuss

even i was amazed to see the quick response

daudmalik06

4 yıl öncediscuss

yes, both of these features are on our roadmap, get in touch with us to stay updated.

thanks

daudmalik06

4 yıl öncediscuss

Well, actually we track all of the CVE lists, security advisories of vendors, package managers and as soon as there's an issue related to the software you use, we notify you. That's it.

daudmalik06

4 yıl öncediscuss

Yeah, you can just upload a composer.lock file and that's it, we will track all of the open source you use and even the software that comes under first level. I.e we track the complete graph.

Feel free to contact us.

daudmalik06

4 yıl öncediscuss

Yes, it can send real time notification of any open source you use e.g maven requirement file.

daudmalik06

Submissions

[untitled]

[untitled]

[untitled]

Ask HN: Is there any founder building non AI startup in 2026?

[untitled]

[untitled]

Tell HN: A company was billed $128K from one leaked GCP API key

$82K GCP bill in 48 hours – so I built an automatic API key kill switch

[untitled]

[untitled]

Show HN: Open-Source Security Monitoring with AI and License Compliance

Attention: RCE Vulnerability Discovered in Laravel

Ask HN: We're tired and need your support

Show HN: Compliant SBOM Management per US Senate Directive

Show HN: Investment opportunity in a cyber security startup

[untitled]

[untitled]

[untitled]

Show HN: A Revamped Vulnerability Database – Rapid and Detailed Reports

Show HN: Vulnerable dependencies in a NPM package with 840k weekly downloads

comments