Appeal — GCP Project bibi-3817.. suspended after API key abuse (Apr 30–May 1, 2026)

Gemini API
1

Dear Google Cloud Support Team,

I am writing to appeal the suspension of my GCP project (Project ID: bibi-3817..) and to
request a goodwill refund for fraudulent Gemini charges incurred between Apr 30 and May 1,
2026.

What happened

I am an independent developer. On Apr 30 I migrated my Gemini integration to AI Studio. Due
to a configuration mistake on my side, my GEMINI_API_KEY was inadvertently exposed in a
public web bundle for a few hours. The key was scraped and abused — my Gemini 3.1 Pro spend
jumped from a baseline of roughly $0–5/day to ~$1,924 in a single overnight window,
exclusively on the most expensive model. This pattern is unmistakably credential abuse, not
real usage. The leaked key has been revoked and the underlying configuration mistake fully
fixed.

My two requests

  1. Restore project bibi-3817… The suspension also disables Google Maps Platform and the
    Google OAuth client running on the same project — services entirely unrelated to the abuse.
    This is the more urgent ask operationally.
  2. Goodwill refund of the abuse-driven Gemini charges (~$1,924). I fully accept that the
    leak was my mistake, but for an independent developer this is genuinely difficult to absorb.
    I would be deeply grateful if Trust & Safety / Billing could consider a goodwill credit.

Constructive feedback on AI Studio

I’m a long-time Gemini user (free → Gemini Advanced → Vertex AI) who only recently moved to
AI Studio. I want to respectfully share that:

  • Paid projects appear to have no default per-project rate limit on Gemini 3.1 Pro
  • The “Monthly spend cap” is labeled Experimental and is opt-in, with no prominent prompt
    during the first paid request
  • A jump from $0/day to $1.9K/day in a few hours triggered no automatic safeguard or
    notification

A modest default cap for new paid projects (e.g., $50/day until explicitly raised) would
have prevented the bulk of this incident. I share this only in the hope it helps the team —
it does not change my responsibility for the leak itself.

Thank you for your time and consideration.

Best regards,
Jimmy Lv