Anyone can run up your OpenAI bill

An AI endpoint with no sign-in and no rate limit can be called in a loop by a bot or one curious person, and your AI provider bills you for every request.

What you see

Your AI provider's usage spikes overnight, or a route like /api/chat answers anyone who calls it, as fast as they call.

Why it happens

The route that calls the model checks neither who's asking nor how often. Scripts find routes like that within days.

How to fix it

1. Require sign-in for anything that costs money.
2. Limit requests per user or per IP, for example with @upstash/ratelimit and Redis.
3. Set a monthly spending cap in the AI provider's dashboard.

Or ask your AI tool to fix it

Paste this into Lovable, Bolt, v0, Replit or Cursor:

Add a rate limit to every API route that calls an AI model: per signed-in user, or per IP for anonymous use (for example @upstash/ratelimit with Upstash Redis), and require sign-in where the feature allows it. Return a clear 429 when the limit is reached.

The full page, with the request ready to copy, is at launchpad.axonscape.com/fix/ai-bill-rate-limit. I work on Launchpad by Axonscape, which runs a free launch check for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.