I noticed that the free plan doesn't require an API key, that could be something that you may consider adding. In Cloudflare you could probably add a WAF rule for header, query string, or cookie values and if not set have CF reject the all.

It's interesting, but SCSS started off with a JavaScript "plugin". We have come full circle. How will Nest handle imports which were or are bad, who knows these days. Tailwind and Bootstrap import hundreds of files. Seems like a bad time and something that would require preprocessing.