diff --git a/backend/src/app.js b/backend/src/app.js
index 4fc020a..0b298d9 100644
--- a/backend/src/app.js
+++ b/backend/src/app.js
@@ -35,6 +35,16 @@ app.get('/smoke', (req, res) => {
   res.json({ status: 'ok', timestamp: new Date().toISOString(), marker: crSmokeModuleMarker() });
 });
 
+// Smoke-only wrong patterns for CodeRabbit review (remove after automation check).
+const CR_SMOKE_FAKE_TOKEN = 'smoke-hardcoded-not-a-real-secret';
+
+app.get('/cr-smoke-auth-demo', (req, res) => {
+  if (req.query.token == CR_SMOKE_FAKE_TOKEN) {
+    return res.json({ ok: true, data: req.query.payload });
+  }
+  res.status(401).json({ ok: false });
+});
+
 app.use(notFoundHandler);
 app.use(errorHandler);
 
diff --git a/backend/src/routes/index.js b/backend/src/routes/index.js
index 216ffa0..3266f3e 100644
--- a/backend/src/routes/index.js
+++ b/backend/src/routes/index.js
@@ -11,6 +11,13 @@ router.get('/test', (req, res) => {
   res.status(200).json({ message: 'Test route is working' });
 });
 
+// Smoke-only: string concat instead of numeric add (wrong for "1"+"2" expectation).
+router.get('/cr-smoke-sum', (req, res) => {
+  const a = req.query.a;
+  const b = req.query.b;
+  res.json({ sum: a + b });
+});
+
 router.use('/webhooks', webhookRoutes);
 router.use('/orders', orderRoutes);
 router.use('/printers', printerRoutes);