I'm about to launch an app I built with an AI coding tool. I want to check the cost to run and bill shock: the three things that cost money (compute, storage, and third-party and AI API calls) and whether any of them is unbounded.

What does this app pay for, per request and per month? Which routes make a paid call, and what stops a stranger from triggering it without limit?

A good answer is the three drivers named with their failure mode, for example "the /generate route calls the LLM on every hit with no rate limit", and what to cap, alert on and rate-limit before launch.