Developer hits $1,310 Google Maps API bill in 48 hours after following Claude AI advice

·7 views

A developer building a personal database of coffee shops in Mexico racked up a $1,310 bill in under 48 hours after using a script written by Anthropic's Claude AI to query the Google Maps Places API. Claude had advised that the project would comfortably stay within Google's free monthly credits, but the estimate proved incorrect. Unlike many other Google APIs, the Google Maps Platform has no default spending cap, meaning automated scripts can generate unlimited charges without real-time warnings. After weeks of escalation, Google approved a 75% refund of roughly $983, but declined to waive the remaining $327, calling it a final decision. The developer is now urging others to independently verify cloud API pricing and set hard budget limits before running any automated scripts.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Every Characterization Test Must Be Made to Fail Before Refactoring

A software development guide published on DEV Community warns that characterization tests recording 'golden' output values provide false confidence unless each test is first proven capable of failing. The author argues that a passing test suite means nothing if the tests were never validated against deliberate code mutations, since silent behavior changes can slip through undetected. The recommended workflow involves recording current behavior, verifying each golden case fails under a minimal code mutation, and only then proceeding with the smallest safe refactor. The article provides Python code examples using a spy-based call ledger and a mutation gate script to systematically verify test sensitivity before any production code is changed. The core principle is that a test earns trust only when it can be made to fail on purpose, not merely when it passes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Auto-Install Intune Company Portal on ADE iPhones Using VPP

IT administrators can automate the installation of Microsoft Intune Company Portal on corporate iPhones during initial setup by linking Apple Business Manager (ABM) with Intune via a Volume Purchase Program (VPP) content token. Without VPP, users must manually install the app and enter a personal Apple ID on a corporate device, which poses operational and data management risks. The process involves acquiring free Company Portal licenses in ABM, downloading a content token, and configuring the enrollment profile in Intune to enable VPP distribution. Apple recommends using a dedicated Managed Apple Account with a restricted custom role to manage the token, since a password change or annual expiry will invalidate it and break app distribution. Administrators are also advised to acquire more licenses than the current device count, as insufficient licenses can block new device enrollments entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev builds leak-free GTA 6 database using only first-party confirmed data

A developer documented GTA 6 characters and regions using a strict rule: only first-party evidence from official sources like trailers and Rockstar's website was allowed. Each entry required timestamps and citations, with no speculative or unconfirmed fields included in the core database. Unverified details were moved to a separate notes layer rather than mixed into the factual index. This approach made the resulting pages more conservative than fan wikis, but ensured a clean separation between confirmed data and community speculation. The developer shared the method on DEV Community, asking whether others maintain similar fact-versus-theory boundaries when building game databases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RubyGems Cache Bug Exposed by OpenAI Bots Highlights npm Supply Chain Risks

A cache-key collision bug in RubyGems' CDN layer was discovered after OpenAI's crawler bots generated unusual high-frequency traffic while indexing package metadata, causing the registry to serve mismatched package data. The flaw meant that under the right conditions, a gem install request could receive metadata or contents intended for a different package or version. No malicious exploitation was confirmed before discovery, but the mechanism existed for an attacker to deliberately engineer cache collisions and push rogue code to unsuspecting users. Security researchers warn that npm faces the same structural risk, as it similarly relies on a CDN-backed caching layer and has already encountered related threats like typosquatting and dependency confusion. Developers are urged to harden their Node.js supply chains through measures such as lockfile integrity checks, scoped packages, and registry allowlists.

0 comments Read more at DEV Community