Setting it up that way is a choice a user would have to make. Just set it up on an oauth or budgeted api and not be an idiot. Setup additional guardrails in OC if you think are necessary.