Google Cloud Functions offers the service at a great affordable price but it has missing pieces like protecting from DDoS and Rate Limiting.

It's very tough to go public with out protecting the product from abuse as at some point down the line we may get unexpected volumes of requests leading to huge bills!

I would like to know what measures you guys follow to protect serverless functions from abuse.