As observed:
- amp-autocomplete has an attribute min-characters which does not show the results in Gmail inbox if no. of characters typed are less than the attribute value; which is fine
- but it actually hits the src endpoint to fetch emote data even if there is no intention of showing that data in inbox
- ideally, min-characters value should be honoured before fetching remote data.
- this increases the number of API hits tremendously
Also, what kind of security measures should be taken to avoid any misuse of API's. Read this but there is not example for implementing this #19