Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, "POST /pins" in "src/filecoin-pinning-server.ts" checks a caller-supplied CID with "CID.parse" and passes it to "pinStore.pin", but does not enforce request rate limits or per-user quotas. In "src/filecoin-pin-store.ts", each pin independently schedules "_processPinInBackground" with "setTimeout" without a queue, semaphore or concurrency cap, then recursively traverses the full DAG using "helia.pins.add(cid)". The per-pin Helia/Bitswap node in "src/create-pinning-helia.ts" has no application-level byte, block or traversal-time limits. Blocks are written under "carStoragePath" by "src/core/car/car-blockstore-base.ts" and "src/core/car/car-file-backend.ts", with "stats.totalSize" updated only after writing. An authenticated caller, or an anonymous caller when "ALLOW_NO_AUTH=true", can submit large DAGs and exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery. The default localhost binding and token requirement reduce exposure. Because nodes have no bootstrap or mDNS configuration, a CID alone may not be fetchable, but caller-supplied "origins" can point to a reachable attacker-controlled libp2p source; concurrent requests accelerate resource pressure. Version 1.1.1 documents operational mitigations but does not implement the missing resource controls.