Paid AI Endpoint Check — Is Anyone Else Spending Your API Budget?
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.
What the issue is
An AI endpoint with no auth and no rate limit lets anyone spend your API budget — scripted abuse burns it in hours, and the invoice arrives with your name on it.
Why AI tools generate it
AI scaffolds wire the model call first and add auth later; later is after the invoice. The endpoint works on the first try, which is exactly the problem.
How DevMeth detects it
A code scan flags routes that call paid AI providers with no session check in the route and no rate-limit evidence in the repo. Auth-gated or rate-limited routes are not flagged. Advisory by design — the review decides intent.
Paid AI endpoints have no auth and no rate limit
WHAT WE FOUND
C45 — masked sample
The fix, in three steps
Require a session, add a per-user rate limit, cap input and max_tokens — and keep the API key server-side.
Run a free scan and each finding carries a paste-ready fix prompt you can act on.
Try a free scanFAQ
My AI endpoint is meant to be public.
Public is fine; unbounded isn't. Keep it public and put the brake on: per-IP/user rate limits and hard token caps. The review is about whether the brake exists.
Why is this flagged as review, not certain?
Contact-form summarizers and similar features are legitimately public. The scan sees paid-call-without-controls; the review decides whether that's intended — and whether limits exist.
What's the fix?
Session check (or explicit public + strict limits), per-identity rate limiting, hard caps on input and max_tokens. Server-side key only.
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.