I have a public website that does not require authentication. It's a lighting calculator for indoor cultivation. Anyone can enter and complete the process and ultimately save your settings for future use sharing it on Facebook or twitter.
The configuration is saved as a document in a database, using a REST api. At this time nothing prevents someone make a bot and fill my hard disk in a few hours.
What steps can I take to give protection to my service?