It will be found
Public endpoints receive automated traffic within hours of existing, whether or not anyone has been told about them. Designing as though only your users will call them is the assumption behind most avoidable incidents.
1. Rate limit by client, not globally
A global limit punishes everyone when one caller misbehaves. Per-client limits contain the problem, and they matter most in front of anything metered — an AI endpoint turns abuse directly into a bill.
2. Validate strictly and cap sizes
Maximum lengths on every field, rejection of anything unexpected, and a limit on request size. Most abusive traffic fails cheaply against strict validation, before it reaches anything expensive.
The cheapest request to serve is the one you rejected before doing any work.
3. Make automated submission unrewarding
For forms, a honeypot field and a minimum completion time filter most bots without asking humans to prove anything — and they avoid adding a puzzle to the page where you already lose people.
4. Don’t leak information in errors
Different responses for “no such account” and “wrong password” turn your endpoint into a lookup tool. Uniform messages and consistent timing remove that, and it costs nothing to implement.
Watch the shape of traffic
Volume, error rates, and unusual patterns are the early signal that something has found you. That belongs in what you log and in whatever actually alerts a person.
Also decide what happens when a limit is hit. A legitimate user hitting a cap needs a clear message, not a silent failure they interpret as your site being broken.