[michaelmrose]

Effective captchas a much worse than logon with google or send a login link to email. Rate limiting might prevent the system falling over or spending all your money but it does near nothing for vandalism.

Rate limiting is like handing your football players packs of condoms instead of cups. It might be necessary but it sure as hell isn't sufficient.

I would suggest that if your app requires interaction with others you provide them with a test experience where they can read live data but not effect others. Gate functionality that might be misused with a request for an oauth2 login or email which you can send a login link to. Near zero commitment don't have to share anything beyond your email and name don't even have to make up yet another password. A few clicks and you are done.

You can provide almost as good an experience as you want without people getting their lols or their dollars off your other users.