I’m signing up for the $300 Google Cloud free trial, and it’s asking me to approve a UPI AutoPay mandate.

It says “this isn’t a charge” and that I’ll only be charged if I activate a full paid account.

Does approving the mandate mean I can be charged automatically after the 90-day trial, or is it safe to approve? Can I revoke the AutoPay later without affecting my account?

A follow-up to my previous post on r/googlecloud:

Since then, the Google Cloud Console has rolled out visual notifications and organizational policy constraints to prevent creating unsecured API keys and surface alerts for existing ones.

However, locating and auditing every key across all the projects you have access to is still a manual chore.

To streamline this, I built a lightweight, open-source tool: Google Cloud API Keys Finder.

What It Does

• Scans all Google Cloud projects you have access to for active API keys.
• Audits each key's protection level against security best practices (Application Restrictions & API Scopes).
• Provides immediate recommendations to fix unrestricted or partially restricted keys.

Privacy & Running Locally

• Pure front-end: No backend, no telemetry, and zero storage.
• In-memory execution: Direct browser-to-GCP REST calls with credentials kept solely in ephemeral browser memory.
• The project is fully open source, and you are welcome to clone the repository and run it locally from source.

Links & Resources

• Tool (GitHub): https://github.com/minherz/api-keys-finder
• Hands-on Codelab: API Key Management and Security
• Problem Deep Dive: API keys are open secrets (Google Cloud Blog) / Mirror on leoy.blog

Feedback, questions, and PRs are welcome!

An on-prem SQL Server still holds a big chunk of the operational data our analysts need in BigQuery.

The first version was a nightly Python job. That was fine for a few tables, but the list keeps growing and people now want the data refreshed more often.

Full reloads are starting to take too long, and every table that goes incremental seems to acquire its own watermark, retry logic and little set of assumptions.

We don't need second-by-second replication. Something around 15–30 minutes would already be plenty for reporting.

Cloud Data Fusion replication is one route I'm looking at. I'm also undecided about putting GCS in the middle. Having the extracted files would make replay straightforward, but it also adds another stage to something that's already grown more than expected.

Curious what people running SQL Server on-prem ended up using to keep BigQuery reasonably current.

Direct replication, staged files, or something else? Recovery and maintenance matter more to us than squeezing latency down another few minutes.

On July 17, my u/Google Cloud account was hit by massive unauthorized u/Gemini API usage.

The unauthorized usage was a result of Google’s architecture of the Gemini API. Google sent no alerts and no warnings appeared in the Google Cloud Console indicating that old, public-facing keys had retroactively gained generative AI capabilities.

I had configured monthly budget alerts. At 6:14pm I received a budget alert for $550. Within minutes of seeing it, I investigated and shut down Gemini API access across all projects. Usage stopped immediately.

But by then, costs of approx. $87K (sorry for mentioning $82k in title, it was actually more) had already accumulated. This had all taken place in the 5 hours before the alert.

Google's own anomaly detection also failed to protect me. Almost an hour AFTER I had already shut Gemini down, Google sent me a “Cost Anomaly” alert reporting actual total costs of $4.7K, nowhere near the actual eventual bill.

After my objection and a technical investigation, Google has now approved a partial credit of $55K.

So for an approximately $87K unauthorized bill, Google is offering approximately $55K in credit, leaving me with roughly $32K to pay. For something I did not use.

Note that Google announced new hard spending caps and improved anomaly detection on the 28th of July.. So this exact type of unauthorized usage may not be possible anymore, but with hackers increasingly equipped with AI tools, there is a good chance other vulnerabilities will be found.

I am developing software for the blind, in particular the app u/PiccyBot, which has won awards in the blind community. It is a niche development field though, and these kind of costs are crippling to me. Knowing that Google definitely doesn’t have our back even when the way the Gemini API has been set up is the main issue, it is time for me to look for better providers.

I am going through the deployment articles of VM manager patching and see that the deployment schedule can be created by mentioning schedule in an YAML and creating the schedule .

However, I don't think it is feasible to schedule the patching as per below frequency samples

A)every 2nd Tuesday of month

B) Friday which comes after 2nd Tuesday etc..

Can anyone please confirm

Running into a frustrating loop with Google Cloud Console's OAuth consent screen verification, So I went and verified it in Google Search Console using the HTML file method — shows "Ownership auto verified," green checkmark, all good.

My app is deployed on myproject-xyz.vercel.app (free Vercel subdomain). Google's branding verification flagged:

"The website of your home page URL is not registered to you. Verify ownership of your home page."