r/Firebase

I'm a 16 year old solo dev building a personal finance tracking app in Flutter for emerging markets. My MVP will require offline capabilities (users have spotty internet), and I need to connect to local bank APIs to fetch transaction data.

For the stack, I'm currently planning

-Local DB: Hive or Isar for offline storage.

-Backend: Firebase (Auth & Firestore) for cloud sync and user profiles.

-Bank integration: Using Open Banking SDKs (like Okra) to get read-only transaction history.

My questions

Is Hive/Isar + Firebase Firestore a scalable combination for a solo MVP or should i look for other alternatives?

When handling local transaction data on the user's device, what are the critical security practices I must implement? I want to protect users even if their phone is lost.

Should I make the Open Banking API calls directly from the Flutter app, or should I run a lightweight Node.js proxy server to handle the token exchange?

I know I have a lot to learn, but I'm committed to the long game. Any seasoned advice would be greatly appreciated!

I’m in a pretty bad Google Cloud situation and looking for advice from people who have dealt with billing or API key abuse cases.

My normal Google Cloud bill is usually around $200/month. This month my project got hit with an unexpected Gemini / Generative Language API bill of around $55k USD. The billing report shows the spike was almost entirely Gemini API usage, not normal Firebase or app traffic.

I pulled Cloud Monitoring data and it shows about 2.2 million Gemini API requests during the incident window. The traffic was tied to one API key UID. That key maps back to a Firebase generated public iOS client key used in my mobile app config, not a Gemini key that I intentionally created or used.

I found out from a Google billing anomaly email. At the time I received the alert, the visible bill was around $2k. Within about 2 hours, I disabled the Generative Language API, restricted the key, deleted it, and later verified that Gemini usage stopped.

The problem is that the bill kept ramping up after that because of billing/reporting delays, and eventually landed around $55k.

Google declined the request to adjust the charges, saying the usage was considered valid because it came through my project/API key.

This morning I got the dreadful Google email: "Immediate action required: Suspension of your Google Cloud Platform / API project " due to "abusive activity consistent with hijacked resources".

Google completely cut me out of the GCP platform that manages my LIVE app. This is not a hobby project, but my livelihood. The email redirected me to my GCP page where I could send an appeal, and do... nothing else. I had no access to anything else so it was difficult even to understand what happened: every action brings me back to "Send an Appeal". Which, of course, I did as fast as possible.

After some digging (apparently the biling page was NOT restricted! Not easy to find) An API key of mine leaked, someone found it and used it to generate images. Two dollars ($2!) of unauthorized spend. My mistake, no excuses.

The part I genuinely cannot solve is this. The notice asks me to revoke the compromised credentials, but I can't do that: `Permission denied: Consumer 'projects/{project_name}' has been suspended.`

I did what I could from outside: deleted the key through AI Studio, rotated everything else, ran a forensic check of my server and confirmed it was only the key, no host compromise. I would gladly pay for support to talk to someone. But guess what, Standard and Enhanced both need an Organization resource, which a personal account does not have, and billing chat is not available to me either (back to "send an appeal")

For a solo developer this is the difference between a bad day and losing the business. It seems absurd a business can get destroyed over a oversight and $2. The reports I read online are disheartening: people wait 1-2 weeks for a response, and then the back and forth is endless. I am going to lose the business I have worked for the past 4 years, and all for $2 and a stupid oversight.

Can anyone help? Has anyone here had a suspension for a stolen API key actually reversed, and how long did it take? And is there any way to reach a human without an Organization resource?

Project is 902887279759, appeal ticket YJ65HT5PKS5FDASU2C73BWIJ5Q, filed 21 Jul 2026. Any help is immensely appreciated

EDIT: Less than 24 hours later, google has re-instated my account! WOOOOHO!