[ivancho]

I mean, there's a whole industry dedicated to preventing abuse of computing resources exposed to the internet. You basically opened your MongoDB instance to the world - you are lucky they haven't already stored anything horribly illegal in there.

[MrRowTheBoat]

Anything is certainly possible on the internet, if or when that happens I'll intervene.

Implementing authentication and or authorization is not beyond my ability, and could have been setup, but it would have severely tarnished ease of access to the platform, and hindered the amount of people who already tried out the service.

[ivancho]

The hubris of software engineers never ceases to amaze me. I'm not trying to scare you here, I am just gently suggesting that you might not have the capacity to provide this as a public service. Keep using it for your projects if it works for you, maybe wrap it in a docker container for other people to deploy on their own if they so want.

Side note, I just tested a curl command with

  -d '{"key": {"$regex": ".*"}, "value": "..."}'

and it went through, updating the already existing first key in the collection, so you're not even sanitizing your inputs - there's likely some Mongo lookup code that will enumerate the existing collections, or overwrite someone else's data, or possibly read all of it, I am not going to continue with the probing (are you sanitizing the api key?). You can either assume good faith from all your users, or open the API to the internet, but definitely not both.