Jeremy 💙 🇳🇱

I'm a Flutter & Dart enthusiast. No RGB keyboards or 42inch widescreens. Just me and my laptop at the dinner table (usually with a great whisky).

[Jeremy 💙 🇳🇱 @plotsklapps]

Just did the refactor for signals 7.1.0. I'm so hoping I did this correctly 😂

[Jeremy 💙 🇳🇱 @plotsklapps]

New clutch, snare and pulley. Anyone ever ridden one of these? Trip down memory lane on Italian engineering. Still rocksolid after close to 30 years #citta #gilera

[Jeremy 💙 🇳🇱 @plotsklapps]

@rodydavis @dart_lang @FlutterDev Just upgraded, testing as we speak 😍

[Jeremy 💙 🇳🇱 @plotsklapps]

@kamranbekirovyz @expenapp Very, very well looking app. Love the arrows and explanations 😍

[Jeremy 💙 🇳🇱 @plotsklapps]

@SEGVeenstra Is this the package you were working on? I'd love to try it, my appstore images are sooo random 🥲

[Jeremy 💙 🇳🇱 @plotsklapps]

LOL, one single refactor absolutely depleted my free tokens for Antigravity IDE 😂

Back to using my own API key in Android Studio 😅

[Jeremy 💙 🇳🇱 @plotsklapps]

@ASalvadorini @antigravity I like the IDE 😍 still using Android Studio more, but keep coming back to see what Google has been cooking with Antigravity.

I particularly dislike the chat coding apps, I don't see myself ever getting used to them.

[Jeremy 💙 🇳🇱 @plotsklapps]

@SEGVeenstra 🥳

[Jeremy 💙 🇳🇱 @plotsklapps]

GYMPLY going strong on Google Play, about 10 downloads a day 🙏 Using it on a daily basis, still loving what I've cooked up 😍

Nostr feed only has me and a few users, that needs to pick up traction though, it's lonely 😂

https://t.co/Ncj6YlAk7r

[Jeremy 💙 🇳🇱 @plotsklapps]

Went on an 8hr ride with colleagues. Body still hurts, but it was sooo good. The Netherlands might be flat, but it's still pretty 😍

[Jeremy 💙 🇳🇱 @plotsklapps]

@RydMike Me going through flex_color_scheme docs

[Jeremy 💙 🇳🇱 @plotsklapps]

Must read. Please protect your keys and at least set a spending cap, now possible via Google AI Studio!

Thanks for the write-up @ulusoyapps 🙏 Hope they rip up the bill soon.

[Cagatay Ulusoy @ulusoyapps]

The GCP project of my @FlutterDev @Firebase app got suspended this weekend for abuse, after a single day of €3,167 in unauthorized Gemini API charges. The root cause turned out to be a #Firebase Hosting default that is hard to know about. Worth sharing what I learned.

I thought the Firebase and Google Cloud project was clean and safe. Client uses Firebase AI Logic (proxy, no on-device Gemini key) with App Check via Play Integrity / App Attest.

The suspension email said "key published on public sources." But: my GitHub repo is private and was never public. flutter build web was never run for this project. Where was the leak surface?

Google AI Studio showed three Gemini-callable keys. Two tight (server-side). One was a "Browser key (auto created by Firebase)" — Unrestricted, since Nov 2024. That was the web app in my generated firebase_options.dart, from when I configured Flutter web at project init.

Here's the part I didn't know about: Firebase Hosting auto-serves your web SDK config at a reserved URL — https://<project>.web.app/__/firebase/init.json — as plain JSON, unauthenticated, to anyone. It includes apiKey, appId, projectId, authDomain.

This endpoint is active whenever you have (a) a registered web app in Firebase Console + (b) any Hosting deploy. Contents of the deployed site are irrelevant. Mine was a simple CSS landing page that doesn't reference Firebase JS SDK at all. Endpoint leaked the key anyway.

Bots scrape *.web.app/__/firebase/init.json because the pattern is universal across every Firebase project. Mine got picked up, the key was Unrestricted (= usable for any enabled API), and someone burned €3K of Gemini inference in a few hours.

Project reinstated after appeal; outstanding balance still in review.

Lessons I missed:
- Auto-generated browser keys are Unrestricted by default (at least the time project was created). Always add HTTP referrer + API restrictions at creation.

- Don't register a web app unless you use the JS SDK.

- Set a Gemini spend cap + budget alert. €100/day cap. You can easily do this in Google AI Studio

What I would ask the Firebase team:

— Browser keys should default to restricted (HTTP referrer to project domains, API restriction to Firebase services) -> not sure this has changed after the date I created the project.

— Reserved __/firebase/init.json should be opt-in. Static websites hosted with Firebase Web hosting do not need the API key info.

— Firebase Console should warn when a key has been Unrestricted for >N days. Google AI Studio warns when you visit API keys page, but it should be visible on homepage.

— Default-on spend caps for Generative Language API.

TLDR; "Private repo" is not a meaningful security boundary when the key has another publicly-reachable surface. Audit not just your code, but every endpoint your project ID exposes including the ones the platform creates for you without telling you. Always manually verify API restrictions.

[Jeremy 💙 🇳🇱 @plotsklapps]

@HarveyAptx Hehe, it's in Dutch, just saying it works fine and that they're happy with the privacy part 🙏

[Jeremy 💙 🇳🇱 @plotsklapps]

My very first review on Google Play 😍

https://t.co/ZBs6LEYv7I

[Jeremy 💙 🇳🇱 @plotsklapps]

@SEGVeenstra Was it read/write media? I even had to update some internal test track from last year to get approved 😂 Had to remove it from manifest.

[Jeremy 💙 🇳🇱 @plotsklapps]

Apparently shared my google console link, but who cares, I'm happy 😂

[Jeremy 💙 🇳🇱 @plotsklapps]

With Gemini’s help, https://t.co/Ncj6YlAk7r now offers one‑time and subscription donations.

Supporters can change the app icon as a small gesture of appreciation. Anything else I should definitely add for supporters?

[Jeremy 💙 🇳🇱 @plotsklapps]

@biz84 Still on Android Studio, with Gemini API key. Been trying out Antigravity as well, but it has not won me over (yet).

[Jeremy 💙 🇳🇱 @plotsklapps]

FUN! GYMPLY supporters now get to choose their appicon. A work in progress, but it works on my emulator 😂

[Jeremy 💙 🇳🇱 @plotsklapps]

@SEGVeenstra 😂 LOL

Congrats on the decision, it looks like a wise one.