Extract backdoor endpoint into separate app