Comment by pokoleo

You should really validate the number of cards. Anybody requesting 1048576 (2^20) cards could be rate limited (or be a chance for a "paid" mode).