Nice. But how do I know you don't save all the passwords for abuse later? ;)
The API is deployed from GitHub directly (main branch), so the code in GitHub is what is online. There is no logging, no tracking, nothing at all. The idea is to build trust with the users, because everyone can check that nothing is logged. I hope I can do that! :)
I am also open anytime for security reviews of the vercel project if desired (there are no log sinks configured, not even for statistics).
Last point: even if some web application uses the REST API to generate phrases, IMO it is impossible to correlate web address (ip), username and password/uuid/wordlist, even if something is logged (the only thing that could be logged would be IP address). Even if you could get the address of the service from the ip (for example nslookup reveals, that for service.domain.com the phrase "passWORD1!" was generated on 28. july 2020), you need to know for what purpose and/or functionality (login, log, whatever) the phrase was created. Assumming it was for login, you need to check all username + this password combinations, and username is unknown, or all reset password, or ... The query to generate the password containts only generation parameters and no further details. Hope this answer makes sense and helps :)