This is indeed a concern to me. As others pointed out, blocking IP addresses is an option. Blocking access based on the HTTP Origin header is also possible. I

This is indeed a concern to me. As others pointed out, blocking IP addresses is an option. Blocking access based on the HTTP Origin header is also possible. I hope I can go on for some time without being to restrictive. With a fairly quick API that can scale with cheap VMs it should be feasible to keep it running at low expenses even at higher utilisation.