B2B SaaS for universities; bill jumped $50/mo to $10,138.28 from Veo 3 + Gemini image tokens via documented legacy-key scope vulnerability (Truffle, Feb 25 2026).
Request sent to https://sipi.bot/v1/transactions/evaluate on 2026-08-30T15:36:31.115033+00:00:
{
"transaction_id": "replay-it-014-1788104190",
"amount": 10138.28,
"currency": "USD",
"merchant": "google-gemini-veo-api",
"description": "Replay of publicly reported incident amount ($10,138.28, 2026-05-06) from https://www.reddit.com/r/googlecloud/comments/1t4xkmf/charged_10138_in_march_2026_due_to_googles/"
}
Exact response:
{
"decision": "BLOCKED",
"reason": "Block any single transaction over $500",
"rule_id": "rul_eff79f00f6",
"triggered": [
{
"rule_id": "rul_eff79f00f6",
"rule_type": "per_transaction",
"action": "BLOCKED",
"label": "Block any single transaction over $500"
}
],
"transaction_id": "txn_921c93a898db",
"amount": 10138.28,
"merchant": "google-gemini-veo-api",
"category": ""
}
For this replayed transaction proposal, the live sipi.bot endpoint returned BLOCKED with the rule shown above.
This is a replay of a publicly reported amount, not a claim about avoided losses. The decision shown is a timestamped observation of the public demo decision API for this single replayed proposal, not a statement about the historical incident or any party's account.
Source checked live at 2026-08-30T15:36:31.115033+00:00.