I have a web page with Google reCaptchav3. It allows to input an ID number, click a button and requests from database some results. If a user input an ID number and click the button, then it generates one reCaptcha token.
An ethical hacker is requesting a LIST of ID numbers with just one token and implies to me that I should program my web page in order to prevent that.
How could I prevent or avoid in my web page that a bot or hacker input a list of ID numbers using only one token? I thougth that was Google reCaptcha job.