Yeah, I think your suggested mitigations sound reasonable. Everything in this space is going to be only partial mitigations, but it should still be discussed, e

Yeah, I think your suggested mitigations sound reasonable. Everything in this space is going to be only partial mitigations, but it should still be discussed, especially if "secure" is a selling point and given that the FaunaDB service is billed based on usage. What I would do: - one-time use token for the creation form, a la CSRF tokens and nonces; Although that just doubles the number of requests needed to perform a submission - rate-limit all endpoints based on IP, user agent, etc - Captcha on creation form