Leaked Claude API key from shut-down project quietly billed months later

The poster says he shut down the VPS servers running his OpenClaw-based project months ago, but the Claude API key tied to that dead project's own, separate billing account was still active, and he recently got a billing alert on that account.

According to his account, the key had no auto-reload enabled, but he believes it was exposed at some point and used much later by whoever obtained it, rather than immediately. He checked his own terminals and sessions and found no legitimate use that would explain the charges, then revoked the account. He frames keeping that key on its own dedicated billing account, separate from his other API usage, as what let him notice and contain the exposure instead of it hiding inside shared usage.