Hello! I'm making a website that has a free tier for authenticated users which lets them call my api (/api/chartbot ) only once per user forever. My purpose is to publish this website so I am concerned about the security of this api route. Below is the code I use (for now) for this api:

export async function POST(req: NextRequest) {
    // Check if user is authenticated
    const supabase = createClient();
    const { data: { user }, error: userError } = await supabase.auth.getUser();

    if (userError || !user) {
        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
    }

    // Check if user has exceeded API rate limit for free tier
    const { data, error: apiCallsError } = await supabase
        .from('users')
        .select('api_calls')
        .eq('id', user.id)
        .single();

    if (apiCallsError || !data) {
        return NextResponse.json({ error: "Failed to retrieve API calls" }, { status: 500 });
    }

    const { api_calls } = data;

    if (api_calls >= 1) {
        return NextResponse.json({ error: "API rate limit exceeded" }, { status: 429 });
    }

    const body = await req.json();
    const chart_response = await generateChart(body);

    // Update user's API calls
    const { error: updateError } = await supabase
        .from('users')
        .update({ api_calls: api_calls + 1 })
        .eq('id', user.id);

    if (updateError) {
        return NextResponse.json({ error: "Failed to update API calls" }, { status: 500 });
    }

    return NextResponse.json(chart_response);
}

I dont want it to be vulnerable to attacks. Some of my questions are: 1. From what I read, no one has access to the code in /api folder. Is this true? 2. What are some good practices for securing or limiting the number of requests of my api? 3. Considering this might be hosted on Vercel, should I add a limit for each IP so I dont get bots spamming my api or is this something vercel deals with already?