I appreciate your concerns. But it's not a public-facing app; it's purely internal, and it only responds to requests that are from the internal network, and have some appropriate API key for the relevant task. We monitor this pretty closely. It can, of course, still happen that we get more requests than we expect, but we have a fair amount of cushioning built into the system.