diff --git a/.gitignore b/.gitignore
index d6358adb4..48bd94df7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,6 +52,10 @@ migration-backup-*/
 migration-backup-complete/
 *.dump
 *.sql
+*.zip
+*.tar
+*.tar.gz
+*.tgz
 migration-*.log
 migration-*.txt
 
diff --git a/app/api/jobs/archive-videos/route.ts b/app/api/jobs/archive-videos/route.ts
index 120fbe0ab..c2f523b9e 100644
--- a/app/api/jobs/archive-videos/route.ts
+++ b/app/api/jobs/archive-videos/route.ts
@@ -22,10 +22,10 @@ function verifyAuthToken(request: Request): boolean {
   // 与环境变量中的密钥比对
   const cronSecret = process.env.CRON_SECRET;
   
-  // 如果未配置 CRON_SECRET，则允许所有请求（开发环境）
+  // 安全默认拒绝：定时任务接口被 middleware 公开放行，生产环境不能在缺少密钥时放开。
   if (!cronSecret) {
-    console.warn("[VideoArchiveAPI] ⚠️  CRON_SECRET 未配置，允许所有请求");
-    return true;
+    console.error("[VideoArchiveAPI] CRON_SECRET 未配置，拒绝执行定时任务接口");
+    return false;
   }
 
   return token === cronSecret;
@@ -109,4 +109,3 @@ export async function GET(request: Request) {
     );
   }
 }
-
diff --git a/app/api/jobs/dingtalk-notifications/route.ts b/app/api/jobs/dingtalk-notifications/route.ts
index 3a01018ba..38f2827f1 100644
--- a/app/api/jobs/dingtalk-notifications/route.ts
+++ b/app/api/jobs/dingtalk-notifications/route.ts
@@ -10,10 +10,8 @@ function verifyAuthToken(request: Request): boolean {
   const cronSecret = process.env.CRON_SECRET;
 
   if (!cronSecret) {
-    console.warn(
-      "[DingTalkNotificationJob] CRON_SECRET 未配置，当前允许所有请求",
-    );
-    return true;
+    console.error("[DingTalkNotificationJob] CRON_SECRET 未配置，拒绝执行定时任务接口");
+    return false;
   }
 
   return token === cronSecret;
diff --git a/app/api/jobs/migrate-oss-images/route.ts b/app/api/jobs/migrate-oss-images/route.ts
index 11e11de7a..b92367260 100644
--- a/app/api/jobs/migrate-oss-images/route.ts
+++ b/app/api/jobs/migrate-oss-images/route.ts
@@ -10,8 +10,8 @@ function verifyAuthToken(request: Request): boolean {
   const cronSecret = process.env.CRON_SECRET;
 
   if (!cronSecret) {
-    console.warn("[OSSMigrationAPI] ⚠️ CRON_SECRET 未配置，允许所有请求");
-    return true;
+    console.error("[OSSMigrationAPI] CRON_SECRET 未配置，拒绝执行定时任务接口");
+    return false;
   }
 
   return token === cronSecret;
@@ -68,4 +68,3 @@ export async function GET(request: Request) {
     );
   }
 }
-
diff --git a/app/api/site-settings/route.ts b/app/api/site-settings/route.ts
index 0e4adec2f..eea04c178 100644
--- a/app/api/site-settings/route.ts
+++ b/app/api/site-settings/route.ts
@@ -922,6 +922,14 @@ export async function GET(request: NextRequest) {
       return getAgentWorkflowAdminSettingsResponse();
     }
 
+    if (!session?.user) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    if (!isAdmin && !canManageAgentWorkflow) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
     const [
       settings,
       notificationSetting,
diff --git a/auto-deploy.sh b/auto-deploy.sh
index bf7547db4..816eeebd7 100755
--- a/auto-deploy.sh
+++ b/auto-deploy.sh
@@ -9,7 +9,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 REMOTE_DIR="/var/www/ai-chatbot"
 
 # 颜色输出
diff --git a/auto_deploy.exp b/auto_deploy.exp
index b3830f72e..1d0ca0f18 100755
--- a/auto_deploy.exp
+++ b/auto_deploy.exp
@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 set local_script "remote_deploy_dreamomni2.sh"
 set remote_script "/root/remote_deploy_dreamomni2.sh"
 
diff --git a/backup-old-server.sh b/backup-old-server.sh
index c9a2605b2..953331efa 100755
--- a/backup-old-server.sh
+++ b/backup-old-server.sh
@@ -8,7 +8,7 @@ set -e
 OLD_SERVER="156.225.27.52"
 OLD_PORT="5204"
 OLD_USER="root"
-OLD_PASS="Jsjj@8888"
+OLD_PASS="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 BACKUP_DIR="./migration-backup-$(date +%Y%m%d_%H%M%S)"
 
 echo "=========================================="
diff --git a/check_server.exp b/check_server.exp
index 8a0c9409b..bb2cd88fb 100644
--- a/check_server.exp
+++ b/check_server.exp
@@ -3,7 +3,7 @@ set timeout 30
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 spawn ssh -o StrictHostKeyChecking=no -p $port $user@$host "echo 'Connected successfully' && nvidia-smi"
 expect {
diff --git a/check_status.exp b/check_status.exp
index 8bca28ac8..ccbfd0270 100755
--- a/check_status.exp
+++ b/check_status.exp
@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 spawn ssh -p $port $user@$host "
     echo '--- GPU Status ---'
diff --git a/complete-deploy.sh b/complete-deploy.sh
index 81789c17c..2a8f79b9e 100755
--- a/complete-deploy.sh
+++ b/complete-deploy.sh
@@ -6,7 +6,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 ssh_cmd() {
     sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -p $PORT $USER@$SERVER "$1"
diff --git a/deploy-fix.sh b/deploy-fix.sh
index edc136b0e..8126a8025 100755
--- a/deploy-fix.sh
+++ b/deploy-fix.sh
@@ -10,7 +10,7 @@ PUBLIC_PASS="it5NuKGemX"
 
 PRIVATE_HOST="192.168.150.22"
 PRIVATE_USER="root"
-PRIVATE_PASS="Jsjj@8888"
+PRIVATE_PASS="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 echo "=========================================="
 echo "部署重定向修复"
diff --git a/deploy.sh b/deploy.sh
index fb2bed465..14d16c132 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -9,7 +9,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 REMOTE_DIR="/var/www/ai-chatbot"
 LOCAL_DIR="."
 
diff --git a/dreamomni2-deploy-guide.md b/dreamomni2-deploy-guide.md
index 92b84b2e4..756bd4776 100644
--- a/dreamomni2-deploy-guide.md
+++ b/dreamomni2-deploy-guide.md
@@ -4,7 +4,7 @@
 - **IP**: 156.225.27.52
 - **端口**: 5204
 - **用户**: root
-- **密码**: Jsjj@8888
+- **密码**: <DEPLOY_SSH_PASSWORD>
 
 ## 🚀 快速部署步骤
 
@@ -14,7 +14,7 @@
 ssh -p 5204 root@156.225.27.52
 ```
 
-输入密码: `Jsjj@8888`
+输入密码: `<DEPLOY_SSH_PASSWORD>`
 
 ### 步骤 2: 上传部署脚本
 
diff --git a/final-deploy.sh b/final-deploy.sh
index ecc4670af..bf88f9442 100755
--- a/final-deploy.sh
+++ b/final-deploy.sh
@@ -6,7 +6,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 ssh_cmd() {
     sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=30 -p $PORT $USER@$SERVER "$1"
diff --git a/finish_setup.exp b/finish_setup.exp
index 128bbd531..6dae06708 100755
--- a/finish_setup.exp
+++ b/finish_setup.exp
@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 puts "--> Connecting to finish installation..."
 
diff --git a/fix-deploy.sh b/fix-deploy.sh
index ca8fe23ce..452b3fdbe 100755
--- a/fix-deploy.sh
+++ b/fix-deploy.sh
@@ -6,7 +6,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 ssh_cmd() {
     sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=30 -p $PORT $USER@$SERVER "$1"
diff --git a/fix-frpc-access.sh b/fix-frpc-access.sh
index e423f5a8f..720ee7837 100755
--- a/fix-frpc-access.sh
+++ b/fix-frpc-access.sh
@@ -6,7 +6,7 @@
 HOST="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 echo "=========================================="
 echo "FRPC 访问问题诊断和修复"
diff --git a/fix-redirect-issue.sh b/fix-redirect-issue.sh
index 2d2817cff..5053ee7e3 100755
--- a/fix-redirect-issue.sh
+++ b/fix-redirect-issue.sh
@@ -10,7 +10,7 @@ PUBLIC_PASS="it5NuKGemX"
 
 PRIVATE_HOST="192.168.150.22"
 PRIVATE_USER="root"
-PRIVATE_PASS="Jsjj@8888"
+PRIVATE_PASS="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 APP_URL="http://156.225.27.52:5245"
 
diff --git a/migrate-server.sh b/migrate-server.sh
index afe1af7b0..3b7d423ef 100755
--- a/migrate-server.sh
+++ b/migrate-server.sh
@@ -9,7 +9,7 @@ set -e  # 遇到错误立即退出
 OLD_SERVER="156.225.27.52"
 OLD_PORT="5204"
 OLD_USER="root"
-OLD_PASS="Jsjj@8888"
+OLD_PASS="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 NEW_SERVER="114.66.31.51"
 NEW_PORT="22"
diff --git a/run_test.exp b/run_test.exp
index b7c19c8e3..0ea6c12d5 100755
--- a/run_test.exp
+++ b/run_test.exp
@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 # 定义测试指令
 # 这是一个更通用的测试命令，先尝试列出文件确认脚本名
diff --git a/run_test_fixed.exp b/run_test_fixed.exp
index c054c3ff7..422628f41 100755
--- a/run_test_fixed.exp
+++ b/run_test_fixed.exp
@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 # 定义正确的模型路径
 set base_dir "/root/ai-projects/DreamOmni2"
diff --git a/run_test_offline.exp b/run_test_offline.exp
index 4588ba696..4bc6d2d0d 100755
--- a/run_test_offline.exp
+++ b/run_test_offline.exp
@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 # 定义正确的模型路径
 set base_dir "/root/ai-projects/DreamOmni2"
diff --git a/upload_and_deploy.exp b/upload_and_deploy.exp
index bca82b9b6..d37b5110e 100755
--- a/upload_and_deploy.exp
+++ b/upload_and_deploy.exp
@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 set remote_script "/root/remote_setup.sh"
 
 # 1. Upload Setup Script (small file, scp is fine)
diff --git a/upload_flux.exp b/upload_flux.exp
index 2806aaf1e..7a644dabd 100644
--- a/upload_flux.exp
+++ b/upload_flux.exp
@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 set local_model_dir "FLUX_Model"
 set remote_base_dir "/root/ai-projects/DreamOmni2/checkpoints"
 
diff --git a/部署状态总结.md b/部署状态总结.md
index 2cbda012f..bda75663c 100644
--- a/部署状态总结.md
+++ b/部署状态总结.md
@@ -129,7 +129,7 @@ cd /Users/lanmu/Desktop/ai-chatbot-main
 npm run build
 
 # 上传并重启
-sshpass -p "Jsjj@8888" ssh -p 5204 root@156.225.27.52 "
+sshpass -p "<DEPLOY_SSH_PASSWORD>" ssh -p 5204 root@156.225.27.52 "
   cd /var/www/ai-chatbot && \
   npm run build && \
   pm2 restart ai-chatbot