If someone finds our growthbook's api key (for the connection) and tries to abuse, and we delete the old keys, if they request using the old keys even though they're deleted, do we still get billed for that? I'm seeing that we're billed, but that doesn't make sense, is it a bug in GrowthBook?

Please reach out to support. They'll be able to help answer your question.