A stolen key does not leak your data. It spends your budget.
The Hacker News reports that AI provider keys customers stored on Railway were stolen in an October breach, then used to run up an estimated $740,000 in unauthorized spending. CISA added an incorrect authorization flaw in IBM Aspera Faspex, CVE-2026-123218, to its catalog of vulnerabilities actively exploited in the wild. The Hacker News also reports that French software company Vates VMS warned of a critical authentication bypass in Xen Orchestra under active exploitation, with no CVE identifier yet.
If your product holds LLM keys, the habit worth building is treating them like money. Keep them in a vault, set hard per-key spend caps with alerting, and make rotation a one-command operation instead of a ticket someone picks up next sprint.
We handle this as a security review of account and payment flows: where every key lives, what each one can reach, and how fast you can revoke a single one without taking the product down. A small scoped review takes days, probably not months.
Tell us which services currently hold your provider keys, and we will come back within a day with cost and timeline.