One of my very first freelance projects something like this happened to me. They were fishy from the beginning - it was a pretty simple project, gluing together

One of my very first freelance projects something like this happened to me. They were fishy from the beginning - it was a pretty simple project, gluing together some CRM stuff with some other system via API calls + Python. I scoped it out, gave them an estimate they agreed to, but they decided they first wanted to see a "POC" (which is now a red flag for me, in this case I did notice that, and made sure it was a very rough copy). I used an API key that was scoped to precisely me and my personal email account. They liked my POC, but kept getting sketchy on negotiation/payment, so I quit the project. Several months later I was getting usage alerts from my API token sent to my personal email. Turned out they were using what I had written (wasn't surprised). I simply disabled the key, and the way it was set up I very much doubt they were able to fix it on their own. The lesson I learned is to never trust a client and that lesson has served me well since. If there is any amount of money you are uncomfortable lighting on fire if still unpaid, insist on being paid up front.