Start with the meter. A scanning group's cost is a function of how much data enters its scope, and scope is one field in the config. Before the fix that field held no filter, so the group covered every log in the org plus APM spans and RUM sessions from sources where, by the author's account, PII could not appear [4]. The feature was doing exactly what it had been configured to do on the day someone switched it on, and that configuration is what generated the bill.
Check the arithmetic before you borrow the number. $390 a day down to $56 a day is $334 saved, and $334 is 85.6% of $390, not the 87% in the writeup [6][1]. Annualise the daily delta and you get $121,910, which is where the reported $120,000 figure comes from [2]. Neither rounding changes the decision, but if you are carrying this to a finance partner, carry the $334 a day.
The saving transfers only if your scanner bills on volume scanned rather than per source, and only if most of your log volume comes from services where regulated fields genuinely cannot land. Three services made the cut here: checkout, onboarding, and the user API, in prod [5]. A payroll processor plausibly does concentrate its PII behind a handful of customer-facing entry points [2]. If yours is spread across every service, that filter buys you nothing and the money is somewhere else.
The ghost services are the sharper failure. A shared logging wrapper called tracer.set_tags with a literal service name [7], and every application that imported it published that name alongside its own [8]. Datadog then treated each phantom as real, so monitors and coverage-audit entries multiplied and an inflated service count fed incident routing [9]. The correction reads identity from DD_SERVICE at the edge instead [10]. It had to ship into more than 30 production repositories, because a hard-coded tag inside a dependency reaches every importer [11]. That is the pattern in this bug class. The blast radius equals the dependency graph, not the size of the diff.
The index leak is the one I would put on a recurring schedule. A group-by on @env against index:main-prod returned 66.1M production events and 24.5M staging [12], and 24.5 divided by 90.6 is 27% [3]. The first read of the quota breach was organic growth; it was the author's manager who looked again and found a 13M day-over-day jump on two services [13][14]. Log indexes are routing rules. Routing rules drift when nobody diffs them [18].
The scanner accounts for $120,000 of the reported total, which leaves at least $30,000 a year across the other two findings, unpriced individually [4]. All three are config files with no reviewer [17]. A codebase usually gets a linter and a second pair of eyes checking changes before they ship. A scanning group typically just gets an install and then a monthly invoice, with nobody assigned to look at it again.
