Put a rate limit and a spending cap on your app's AI calls

Many vibe-coded apps call OpenAI, Anthropic or another paid AI API every time a visitor clicks a button. If that route has no limits, anyone can write a small script that hits it thousands of times, and you pay for every call. Routes that send emails or text messages have the same problem.

Keeping the key on the server stops people from stealing it. It doesn't stop them from using your route.

The fix: ask your builder to require login for every route that calls a paid API, and to cap how many requests each user can make per minute (Vercel's firewall or Upstash can do this). Then set a monthly spending limit in your AI provider's billing settings, so a bad day has a ceiling.

Want an outside check of your live app? Run the free 15-second scan at leakyvibe.com.