# Backend alpha deployment note

The first persistent backend listens on `127.0.0.1:8090`.

Do not expose it publicly until:

- admin endpoints have explicit role enforcement;
- Telegram initData validation is wired from the Mini App;
- rate limits are applied;
- CORS/headers are reviewed;
- systemd service and backup policy are added;
- API integration tests cover the HTTP server itself.