The endpoint that will happily DoS your wallet
Unrestricted Resource Consumption

An attacker finds the API surface of a SaaS product from its public docs. No login required for a few endpoints, login required for the rest.

1. 1
   Find the expensive endpoint

   They look for the route that does the most work per call. /api/export/csv wins — it streams the whole projects table through a transformer.
2. 2
   Turn up the volume

   They call it in a loop from 50 IPs. The backend fans out to the database, which fans out to the read replica, which starts queueing. The service degrades for every real customer simultaneously.
3. 3
   Point at the expensive dependency

   On the unauthenticated /api/chat endpoint, every request costs 30 cents in LLM tokens. They run 10,000 requests an hour. The Anthropic bill for the day is $72,000.
4. 4
   Abuse the SMS endpoint

   Meanwhile /api/send-otp takes a phone number and sends a code. They pipe an entire country code range through it. Twilio charges per send. Nothing rate limits by IP, by user, or by recipient.

The app is still up, technically. Three different vendors are sending the founder urgent billing emails. Real customers can't load the dashboard. The only mitigation the team has is to pull the plug.

// app/api/search/route.ts
export async function POST(req) {
  const { query, limit } = await req.json();

  // limit: 1000000 is a perfectly legal request
  const results = await db.product.findMany({
    where: { name: { contains: query } },
    take: limit,
  });

  return Response.json(results);
}

// app/api/search/route.ts
import { z } from 'zod';
import { rateLimit } from '~/lib/rate-limit';

const SearchSchema = z.object({
  query: z.string().min(1).max(200),
  limit: z.number().int().min(1).max(50).default(20),
});

export async function POST(req) {
  const session = await getSession(req);
  if (!session) return Response.json({ error: 'Unauthorized' }, { status: 401 });

  const ok = await rateLimit(`search:${session.userId}`, { max: 60, window: '1m' });
  if (!ok) return Response.json({ error: 'Too many requests' }, { status: 429 });

  const { query, limit } = SearchSchema.parse(await req.json());

  const results = await db.product.findMany({
    where: { name: { contains: query } },
    take: limit,
  });

  return Response.json(results);
}

Three layers: a schema that caps the input (limit max 50, query max 200 chars), an auth check so anonymous floods bounce, and a per-user rate limit that stops even authenticated abuse. Apply the same three layers to anything that calls a paid API.