I didn't see things like authentication/CORS/... mentioned in the docs, so it probably is intended to deploy this behind some kind of API gateway taking care of things like that? Or did I just miss it?
Documentation is the projects highest priority at this point, as it has most of the features people need when creating an API, is battle tested in several production systems, and is highly configurable / extendable for anything missing. We're taking the time now to write down all the "hows" and hope to make video tutorials soon as well.
Right now it seems like a lot of great features are not presented at all.