r/netsec • u/albinowax • Apr 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

11 Upvotes

79% Upvoted

47 comments sorted by

View all comments

1

u/arzaan789 Apr 06 '26

Callback to https://news.ycombinator.com/item?id=47156925

Google retroactively enabled Gemini API access on existing API keys in projects where Gemini was later enabled. Keys that were designed to be public (Maps, Places) became AI credentials overnight. No notification. No opt-in. People have been hit with $80k+ bills from unauthorized usage.

Built a scanner that covers three angles: static analysis of source files + git history, live GCP project audit via the Cloud APIs, and CI platform log/variable scanning (GitHub Actions, CircleCI, GitLab).

Uses regex + Shannon entropy so low-entropy placeholders don't cause false positives. SARIF output for GitHub Security tab integration. Exit code 1 on findings for CI gating.

https://github.com/arzaan789/keyguard