Nobody checks your user count before scanning for vulnerabilities

Fri, 03 Apr 2026 00:00:00 +0000

It started with a $10 charge from Google Cloud on my bank statement. That might not sound like much, but Google Cloud usually costs me less than a dollar a month. There was no reason for it to spike.

A few days earlier, I’d received an email from a security researcher, asking if Fastbooks had a vulnerability disclosure or bug bounty program. It was polite, professional — the kind of email you’d expect from someone doing this the right way. I replied honestly: Fastbooks is a weekend project with no revenue, no bounty program, and the best I could offer was an acknowledgement on the website if he found something worth reporting.

Firebase on Haris Ali - Product Human from the Maldives

Nobody checks your user count before scanning for vulnerabilities