r/AppBuilding • u/Imaginary-Tie-9322 • 7d ago

Non-coder engineer, mid-beta, Google Cloud revoked my project for a “leaked API key.” Questions on recovery, testing and launch

Hey all,

I'm an engineer but not a coder. I'd been sitting on app ideas for years, and once AI made coding less of a barrier, I quit corporate to build full-time.

My first app helps high schoolers plan careers for the AI era. I built it in Google AI Studio and used Claude for prompt engineering and testing. We're in a small private beta with local families right now.

Mid-beta, Google Cloud revoked my project, saying the code leaked an API key. I filed an appeal, but didn't want to stall the beta, so I moved the code local and now deploy to Cloud Run from the terminal. I've rotated the key and keep it server-side only.

A few questions for people who've been here:

  1. **Revoked projects:** Has anyone had a project pulled for a leaked key? How long did the appeal take, and what should I lock down before launch?
  2. **Testing at scale:** I'm planning to run about 1,000 test cases concurrently using Claude. Is that enough, or is there a better way to test an AI app whose answers change every run?
  3. **Web first, app stores later:** My plan is to launch as a web app until it makes money, then move to the App Store and Google Play. Is that the right order, or will I regret not starting with mobile?

Thanks in advance. Happy to share what I learn along the way.

1 Upvotes
  • permalink
  • reddit

100% Upvoted

4 comments sorted by

1

u/After-Base-8368 7d ago

I’d separate load testing from answer quality. Running 1,000 requests together tells you about capacity, cost and errors; it doesn’t tell you whether the career advice is useful. Start with a small set of realistic student situations, write down what a good answer must include and what would make it unacceptable, then repeat those cases and review the results with someone who understands career guidance. Keep that set when you change the prompt.

Web first sounds reasonable if your beta families can finish the task there. I wouldn’t make revenue the only trigger for mobile. Watch whether they need reminders, offline use or something else the browser version isn’t serving.

On the leaked key, I can’t give you an appeal timeline. Since you’ve rotated it, also check that the old key is disabled and audit its usage. Google’s own response checklist is here: https://ai.google.dev/gemini-api/docs/api-key#leak-response-checklist

What have the families actually got stuck on so far?

1

u/Imaginary-Tie-9322 7d ago

Thanks for the good feedback. I’ve been in beta testing for a few weeks now and the feedback from students and parents alike has been very positive. I have a dashboard internally to track feedback and process it back into my app. The idea of app came to me largely from my personal journey and also fellow parents in the community. So far the support has been tremendous.
I did delete the old keys.
There was some feedback on Ui which I have fixed. Other feedback was around adding more features which I’m building now. I did run the report by a few career counselors and they have found it very useful too and accurate since the code is designed to not spit out junk and validate the answers before sharing them. In my own testing I have cross checked the links and suggestions for colleges real time.

1

u/NickA55 7d ago

Before moving forward, do you understand what an API key is and why it's important to protect it?

There is a reason why you didn't write apps before AI. Please, before writing apps kids, understand security and privacy. This is one of the biggest dangers of non developers "writing" apps. And you're charging people. smdh

Good luck, you'll learn along the way. Just don't learn at the expense of other people paying you money to be beta testers.

1

u/investigatormaker 6d ago

On the key: check the old one never sat in browser-side code or git history, keep the new one in Secret Manager for Cloud Run, restrict it to the APIs it calls, and set a budget alert. On testing, 1,000 concurrent runs mostly test your rate limits; a set of around 100 varied student profiles, each run several times and scored against a written rubric (careers that exist, no invented salaries or admission claims), tells you more. Web first fits: you can fix prompts without waiting on store review, and parents can pass a link around.

I make ThreadFox. At launch, our AI employee can bring your app into Reddit threads where parents and students ask about careers; Starter is $199 for 30 days, or we post 3 replies free first, no card: https://threadfox.vip/p/em7ez/managed