As an update to this, we have had to continue fighting bots swarming the site. They have been coming in waves and when we shut down one avenue for them they continue searching for others.
We had hoped that Cloudflare anti-bot measures (the challenge where you tick to confirm you aren’t a bot) could protect the site with minimal intrusion, but those aren’t going to work. Cloudflare blocks uploading large experiment changes (anything over 100mb) but we also suspect the success would also be shortlived - there are certainly blog sites describing ways to evade the Cloudflare challenges too.
So, after a few weeks of trying to keep the site as open and friction-free as possible, we have concluded that we need to convert all Public projects to be Internal projects. That means those projects will now require the user to be registered in order to view the materials (but running the study as a participant will still not require a username, just as with Private projects are still visible to participants). Accessing the code and data for all projects including demos will now require a log in, at least until we find a better way to defend against bots.
We are very confident that preventing fully-public access will solve the problem - we were just looking for less restrictive ways to solve it.
Thanks you for your understanding and patience as we deal with these new and evolving challenges. We appreciate it has been a frustrating experience for users (and for us! 
)
Best wishes,
Jon