To prevent abuse, I'm using Cloudflare Turnstile to challenge bot access. Since the server validates the token from the browser, curl doesn't work—you'll have to use the web UI to upload. It's the simplest way I could keep the spam away for now.

That's what I was worried about... Thanks for the answer!

why is it a problem?

Because you can't use it in a CI

Good point. I‘ll be adding login and API support soon