fix version 1

pkgs/all/etc/default_dev.yaml

@@ -14,12 +14,15 @@ Databases:
     - host=127.0.0.1 user=postgres password=Weidong1214 dbname=bsm_dev port=5432 sslmode=disable TimeZone=Asia/Shanghai
 
 Cache: redis://null:Weidong1214@127.0.0.1:6379/1
-SecretKey: CHANGE_ME
+
+# session cookie 的 HMAC 密钥，必须由部署通过环境变量提供，不得留空或使用公开占位值。
+SecretKey: ${BSM_SECRET_KEY}
 
 # Authorization contains the HS256 signing key and maximum token lifetime in
 # seconds. Clients send the raw JWT in the Authorization header (no Bearer).
+# 签名密钥必须由 BSM_JwtSecretKey 环境变量提供；公开样例值会被入口拒绝。
 Authorization:
-  Key: CHANGE_ME_32_BYTE_JWT_SECRET_KEY
+  Key: ${BSM_JwtSecretKey}
   Expire: 86400
   Anonymous:
     - /passport.Login/Pwd