Short, sourced notes on cloud-exit economics and running boring, predictable infrastructure. A new one goes up most days — subscribe at the bottom so you don't miss it.
Grab the free checklist — the one-page guide to stopping a surprise cloud bill →
Day 11 of the AI cost + safety playbook, opening the security-base module. The fastest way to a five-figure AI bill isn't a clever attack — it's putting the API key somewhere a stranger can read it. Where LLM keys leak (client code, repos, git history, logs, prompts), and the handling discipline — server-side only, scoped, vaulted, rotated, one per app — from someone who's spent 20 years treating credentials as liabilities.
A leaked key, a looping agent, a free-trial credit that ran out mid-month — and now there's an AI bill with a comma in it you never meant to spend. Before you pay it: providers waive first-time accidental and abuse-driven overages more often than you'd think. Here's how to ask — OpenAI, Anthropic, Bedrock, Vertex, Gemini — and the framing that works.
Day 10 of the AI cost + safety playbook, closing the abuse module. The risk here isn't the bill — it's what your bot says. A dealership bot talked into a '$1, legally binding' car; an airline held liable for a refund its chatbot invented; a delivery bot swearing at customers. Why 'the AI said it, not us' doesn't hold, and the output guardrails that keep a jailbroken bot from committing you to anything.
AI cost is almost never spread evenly. A handful of users — sometimes one — drives most of the spend, and the monthly average hides them completely. Here's how to find the heavy users in 15 minutes, tell the difference between a power user, an abuser, and a bug, and cap each one without punishing everyone else.
Day 9 of the AI cost + safety playbook. Not every abuser wants to hijack your bot — some just want free inference. Put an LLM behind a lightly-guarded endpoint and you've published a free ChatGPT proxy on your bill. How people find it, why it's a cost AND an account-ban risk, and the auth + quota + topic-lock defenses that actually box it — with the honest note on which of those are real boundaries and which are just speed bumps.
Plenty of AI features are quietly unprofitable — the model call costs more than the user pays for what it does, and volume makes it worse, not better. Before you scale it, run the unit-economics check: what one use actually costs you, what it earns, and the three fixes when the number is upside down.
Day 8 of the AI cost + safety playbook. Direct injection needs the attacker to be your user. Indirect injection doesn't — the malicious instructions ride in on a web page, a PDF, a support ticket, or a RAG document your model reads for an innocent user. Why it's worse than Day 7's version, the real attack shapes, and the defenses (least agency, untrusted-content isolation, egress allowlists) that actually help.
Your agent is looping, or a key got abused, and the meter is running as you read this. Don't reach for a playbook — reach for the stop button. The exact order to kill the spend, trace what's calling, cap the account, and preserve the evidence you'll need to get it waived. Then the fix so it can't happen twice.
Day 7 of the AI cost + safety playbook. The #1 risk on the OWASP list, shown by breaking a demo I built. Why direct prompt injection works — the model has no boundary between your instructions and the user's text — why 'just tell it not to' isn't a fix, and the defense-in-depth that actually shrinks the blast radius. Learning in public: including that this one has no clean solution.
The scariest AI bill isn't a clever attack — it's a valid key someone found and used. A leaked key walks past every cap and gate you built, because to your system it looks like you. Here's a 10-minute self-check: the seven places AI keys leak, how to look in each, and exactly what to do the moment you find one.
Day 6 of the AI cost + safety playbook, and the start of the abuse module. The OWASP Top 10 for LLM Applications is the field's shared checklist — but it's written for security people. Here's each of the ten risks in plain language, the real incident that shows it, and the one control that helps — plus the four that actually bite a small team first.
Day 5 of the AI cost + safety playbook. The caps from Day 4 stop the runaway; now we lower the number you're capping. Four levers, all at the gateway: response caching, provider-side prompt caching, cheap-model routing, and batching — plus the honest caveats (cache invalidation, personalization leaks, quality drift) and the measurement discipline that lets you actually claim a number.
Everyone repeats that Infrastructure-as-Code makes you provider-agnostic. It doesn't — an AWS config isn't a Hetzner config with one variable flipped. Here's what Terraform actually buys a cloud-exit strategy, the layer above it that's genuinely portable, why I'm learning OpenTofu (not Terraform) and pairing it with Ansible, and where Pulumi fits. A developer-to-developer walkthrough.
Monthly budgets and rate limits miss the failure that actually empties the wallet: one agent run stuck in a loop, paying full price for the same broken call all weekend. Here is a per-run, failure-aware circuit breaker built as a LiteLLM plugin — it cuts a stuck run on the request path (identical call twice, error twice, or over its session budget), verified live against a local model.
The recurring wisdom in every self-hosting thread isn't ideological — it's 'I host everything myself, except email and DNS.' That carve-out is the whole framework. Here's the honest per-service decision: move the things whose cost scales with your success, keep managed the things that are cheap to rent and painful to run.
A local open model for the boring bulk, the frontier API only for the hard 20% — one Reddit user calls it the 'turbo model.' It can cut an AI bill by ~90%. But the cost doesn't vanish; it moves from a per-token meter to fixed hardware, power, and your own time. Here's the real hardware cost, the break-even, and the three hidden charges that decide whether it actually saves you money.
The highest-leverage AI cost lever isn't caching or a cheaper model — it's not making the call at all. A sharp point from a SaaS-founder thread: people lazily use an LLM to DO tasks they should use an LLM to WRITE CODE to do. Doing the task is recurring metered compute; writing the code once is a capital investment that then runs for free. Here's when to reach for which.
During the MVP the AI bill looks harmless. Then the product works, usage grows, and the same prompts run millions of times. A SaaS-founder thread named the exact culprit: routing deterministic, repeatable jobs — extraction, classification, normalization — through the biggest, priciest models. Here is the list of tasks that quietly detonate, and what to send instead.
The recurring complaint about every cloud cost platform, from the people who actually run them: they give you visibility without the power to execute the fix. A dashboard names the idle box, the untagged sprawl, the open IAM gate — and then leaves them running. The maturity marker isn't a nicer chart; it's remediation. The same lesson the AI per-run breaker teaches, on the cloud side.
A Google Cloud user watched a $50-a-month account bill almost $20,000 in a single day. The 'billing cap' didn't stop it — the threshold rose as the spend rose, the card was charged in chunks, and when the card finally failed the servers kept running. This is not a bug. Cloud billing has no hard cap by design, and here's what actually stops the meter.
A FinOps engineer's question cuts to the core of agent cost control: most of the money a runaway agent burns is spent after the failure signal already fired. A bill-anomaly alert catches it a day late. The fix is a breaker that lives on the request path — at the gateway, per run — not on the invoice.
A developer asks why their GCP $300 trial and a $1,000 GenAI credit won't spend on Claude — and nobody can quite say. That confusion is the real story: free credits and split billing agreements hide what an AI call actually costs, so you're building on a meter you can't read — subsidized by someone else, with the real number deferred to later.
The reason startups run resources 24/7 and eat six-figure bills isn't that engineers are dumb — it's that cloud cost has no owner. One overworked person owns infra, security, on-call, and cost for five teams, and cost is the thing that quietly loses. The fix isn't another dashboard; it's an owner.
Day 4 of an AI cost + safety playbook. The gateway from Day 3 gave us a door; now we bolt on the first control — a global hard spend cap plus per-user quotas. Two different things, and you need both to turn Day 2's fail-open bill into one that fails closed.
Day 3 of an AI cost + safety playbook. Every control in this series — spend caps, quotas, caching, key vaulting, a kill switch — needs one place to live. That place is a gateway: a single proxy every LLM call passes through. It's a pattern you already know, and often a one-line change.
Day 2 of an AI cost + safety playbook. One LLM call is cheap; you go broke when the number of calls — or tokens per call — goes unbounded. Five ways that happens in real systems, each a fail-open default that keeps charging until something breaks.
This site runs self-hosted, cookieless Matomo, not Google Analytics. The reasoning is the same as everything else here: own the thing that matters, and don't rent your independence. What Matomo is and how it's used, an honest comparison to Google Analytics, when "free" Google becomes a liability (EU law, forced migrations, sampling), and the privacy-and-independence philosophy underneath — with the honest caveats about when GA still wins.
Day 1 of an AI cost + safety playbook, in the open. LLM calls are billed per token — input and output priced separately, and output runs 3–5× higher. Here's why, the two dials on every call (how much it says, how much it reads), and the arithmetic worked on real prices.
An LLM API is metered per token, uncapped by default, and fails open — to your wallet. Worse than cloud in three ways: the meter runs faster, the endpoint is built to accept anything from strangers, and your AI can be turned against you. Here's what fail-closed looks like for AI.
Every 'surprise AWS bill' story shares one root cause nobody names: the account has no ceiling. Unlimited postpaid billing is the default, it fails open — to your wallet — and it scales from a student's $1,100 to a funded startup's six-figure weekend. Why the default is reckless, and the fail-closed alternative.
A surprise AWS bill — a resource left running, or a leaked key someone abused — is one of the most common panics in cloud. Here's how to ask AWS to waive a first-time accidental bill (it works more often than you'd think), and the six guardrails that stop it happening again.
The follow-up to the CloudWatch per-scan post: the exact self-hosted setup that replaces it — Grafana + Loki on a flat-rate box where queries are free — with the hardware, a docker-compose to copy, the migration path, and the real savings.
Amazon CloudWatch Logs Insights bills per gigabyte your queries scan, not per gigabyte you store — so an always-on dashboard on auto-refresh quietly becomes a metered query loop that can cost more than the rest of your logging combined. Here's the trap, how to spot it on your bill, and the fix.
Most SaaS teams go hunting for an extra $100k in revenue. At any real scale, that money is usually already in your AWS/Azure/GCP bill as pure waste — across four predictable line items. Here's where it hides and how to find yours in an afternoon.
A SaaS founder's Google Cloud bill jumped from ~$200/month to ~$55,000 in a single billing cycle — one public Firebase API key, abused against the Gemini API. Here's exactly how it happens, how to fight the charge, and the five settings that cap it for good.
Storage and compute have list prices you can shop on. Egress is the line that quietly scales with your success — and it's the one almost nobody budgets for. Here's how to find it on your own bill in five minutes.
I publish honest, sourced breakdowns of cloud-exit economics — egress, storage, monitoring, reliability — and the occasional announcement. Leave your email and I'll let you know when something new goes up.
Double opt-in — you'll get one email to confirm. No spam, unsubscribe anytime. Read by me, never shared.