Comment by opsmeter

This reads like an “incident without guardrails”: per-project caps/quotas, anomaly alerts (minutes), env-split keys, and an automated kill-switch should be defaults for usage-based APIs. Billing emails are post-mortems.