title: Denial of Service attack on Parse.com app
body: <p>I'm writing a small web application as I'm learning to use the features of Parse.com.</p>
  
  <p>Since <strong>application_id</strong> and <strong>javascript_key</strong> are both public (as explained in the doc), it means anyone is free to run code like illustrated in the following snippet:</p>
  
  <pre><code>function sendRequest(){
  
      var query = new Parse.Query(Parse.User);
      query.find({
  
          success: function(results) {
              console.log("Request sucessful");       
          },
  
          error: function(error) {
              console.log("Request error: " + error.code + " " + error.message);
          }
      });
  }
  
  setInterval(sendRequest, (1000 / hitsPerSecond));
  </code></pre>
  
  <p>I think it can lead to "DOS" attacks pretty easily - anyone willing to bring this app down would only need to recover the public keys and send lots of requests.</p>
  
  <p><strong>edit</strong> Accounts have a request/s limit, free plan begins at 30, but using this simple script can saturate any subscription plan.</p>
  
  <p>considering this is correct - is there any good practice against this? Any pattern to apply?</p>
  
  <p>Thanks in advance,</p>