Security concern about public endpoint

[fescobar]

With your solution, everybody can request directly your endpoint and send emails for free.
https://github.com/manuarora700/sendgrid-contact-form/blob/main/pages/api/sendgrid.js

[manuarora700]

The from and to values are hardcoded - Even if someone uses the API, it'll land in my inbox. Since the contact form is public and anyone can use it, I haven't made any Allowed List on SendGrid.

Please let me know if I'm missing something.