Has anyone experienced a GCP project suspension where the appeal has gone unanswered beyond the stated 2-business-day window? Sharing our situation in case a Googler can advise — Ticket: R4JSVY4M2AUXPIWHPJKV4MAZOE"
Here is the full context:
Project ID: aili-dev
Our project was suspended after Google detected activity associated with
compromised credentials / API key misuse. We investigated and identified
that a Google API key had been exposed in a repository .env file.
Remediation already completed:
- Removed the exposed
.envand related cache artifacts from the repository. - Rewrote git history to purge the exposed files from all commits and pushed
the sanitized history. - Added ignore rules so
.envand Firebase temp/cache artifacts cannot be
recommitted accidentally. - Reviewed the repository for additional committed service account private keys
— none found.
Current limitation:
- The project is suspended and the console redirects only to the Appeals page.
- We are blocked from accessing Service Accounts / Credentials to complete
in-console rotation and deletion of the affected credential.
What we will do immediately upon restored access:
- Rotate and delete the affected API key(s) and any other potentially affected
credentials. - Review API activity, audit logs, billing activity, IAM changes, and all
project resources for unauthorized usage. - Delete any unauthorized resources if found.
- Apply or tighten API key restrictions.
The exposure was accidental and the abusive activity was not authorized by us.
We believe a leaked credential was obtained and used by an unauthorized third party.
Request: Please review the remediation completed and restore access, or provide
minimum access needed to rotate/delete the affected credentials.
Has anyone experienced this situation and found a way to escalate past the 2-day
window? Any guidance from Google staff would be greatly appreciated.