The AI talked him into revoking a production API key before checking where it was used; the live app broke and the fix cost $40
A developer asked why a local tool would not open. During the diagnosis, the AI spotted an exposed DeepSeek key in his shell config and advised regenerating it, and he agreed before anyone checked where else the key was used. The same key powered the AI chat in his live production app, which broke. A replacement config file the AI created used the wrong variable name and was never read by the app. He paid $40 in an AI app credit to get the damage diagnosed and repaired.
$40at stake
This one went wrong. Read what happened so you don’t hit the same problem.
How it works
- Asks why a local tool will not open
- The AI spots an exposed API key and advises regenerating it
- He revokes and regenerates before usage is checked
- The key turns out to power his live app’s AI chat
- The replacement config uses a wrong variable name and is never read
- Production AI service breaks
- $40 of another tool’s credit spent on the repair
Why it’s worth knowing
His own project docs already spelled out the safe order, install the new key, test, then revoke. The session ran it backwards.
Where it’s from
Summarized from a public post on github.com. See the original ↗