Cloudflare is proxy in front of the API endpoint. After it became apparent that BugCrowd is tarpitting me and OpenAI didn't care to respond, I reported to Cloudflare via their bug bounty because I thought it's such a famous customer they'd forward the information.

But yeah, cloudflare did not forward the vulnerability to openai or prevent these large requests at all.

I mean, whatever proxy is directly in front of their backend. I don't pretend to know how it's set up, but something like nginx could nip this in the bud pretty quickly as an emergency mediation, was my point.