What happens when your OpenRouter key gets stolen? Nothing. Then you move on.

Short summary

A developer's OpenRouter API key, exposed in environment variables, was stolen and used to drain their account with zero alerts or spending caps. The platform lacked default security safeguards including spending limits, unusual activity notifications, and accessible support channels. The incident reveals critical gaps in API platform security UX that leave developers vulnerable to credential compromise.

• •Exposed API key was stolen from env variables and drained account balance with no alerts
• •Platform lacked spending caps, usage spike notifications, and accessible security controls
• •Highlights UX gaps in API platform security that leave developers vulnerable

Generated with AI, which can make mistakes.