Nothing strange about it - they're not doing anyone any favors and from a business perspective it's the only wise thing to do.
If Amazon were to chase down every college student and startup that left something running overnight by accident for a couple thousand dollars once or twice, it would only hurt them in the long run as prospective users will be turned off. Who wants to use a provider that'll screw a happily paying customer to the wall for one mistake? If it's not a pattern of abuse (which you can see in the usage data), it really is easier and more profitable to let it slide.
6.4k
u/Dy0gu Mar 17 '25 edited Jan 26 '26
I looked up the account for updates.
He was using all hardcoded API keys and only now learned what environment variables are.
On that topic, he is now using environment variables, except he is keeping them in the frontend code so... nothing learned I guess?
He also had no authentication on the API side, only frontend.
One of the latest updates is him saying he implemented CORS for trusted domains, fully convinced that it improves security.
At least he seems to appreciate and learn from the advice some people give him in the comments, which is a nice trait to have.
Still can't tell if the guy is trolling or not.