OP: You might want to add some basic rate limiting in the range of 3+ clicks per second. Currently you can flood the http endpoints to spam a single action (like backspace). Given GitHub's TTFB of 700ms for this page, I don't see how a regular person could type anything quicker than that, unless they had multiple tabs open.