diff --git a/.scripts/verify-vault.mjs b/.scripts/verify-vault.mjs
index b405396..6f8863f 100644
--- a/.scripts/verify-vault.mjs
+++ b/.scripts/verify-vault.mjs
@@ -5,7 +5,14 @@ import { readFileSync } from 'node:fs'
 
 // 值形态的占位符 / 环境引用：不算泄漏
 const PLACEHOLDER =
-  /(\{\{|<[^>]*>|\$\{|process\.env|\benv\[|your[-_]|example|sample|placeholder|changeme|redacted|\bxxx\b|\.\.\.|\[hidden\])/i
+  /(\{\{|<[^>]*>|\$\{|process\.env|\benv\[|\byour|example|sample|placeholder|changeme|change_me|redacted|\bxxx\b|\.\.\.|\[hidden\]|super[_-]?secret|environ|\.\w)/i
+
+// 公共默认口令：不算泄漏（本地开发默认值）
+const DEFAULT_VALUES =
+  /^(postgres|hass|litellm|root|changeme|admin|123456)$/i
+const DEFAULT_SUFFIX = /(?:^|[_-])(?:password|passwd|secret|token|key|config)$/i
+// 全大写下划线 = 未填的配置名占位（如 MAILBOX_PASSWORD）
+const CONFIG_NAME = /^[A-Z0-9_-]{8,}$/
 
 // 只报路径与行号，绝不打印匹配到的内容
 const KEY_PATTERNS = [
@@ -22,7 +29,7 @@ const KEY_PATTERNS = [
   // 关键字赋值 / 表格单元格：PASSWORD=… / token: … / | API_KEY | …（值须 ≥16 位密钥形态字符）
   [
     'credential-assign',
-    /[A-Za-z0-9_-]{0,32}(?:password|passwd|pwd|token|secret|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|bot[_-]?token|private[_-]?key|credential)["']?\s*[:=|]\s*["']?([A-Za-z0-9_+/=~.!@#$%^&*?:-]{16,})/i,
+    /[A-Za-z0-9_-]{0,32}(?:password|passwd|pwd|token|secret|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|bot[_-]?token|private[_-]?key|credential)["']?\s*[:=|]\s*["']?(?![/~$])([A-Za-z0-9_+/=~.!@#$%^&*?:-]{16,})/i,
     true,
   ],
   // Telegram bot token：<数字id>:AA<hash>
@@ -30,8 +37,8 @@ const KEY_PATTERNS = [
   // 带内嵌口令的连接串 postgres://user:pass@host
   [
     'conn-string',
-    /\b(?:postgres(?:ql)?|mysql|redis|mongodb(?:\+srv)?|amqp|smtp|mssql):\/\/[^\s'"@:/]+:[^\s'"@]{4,}@/,
-    false,
+    /\b(?:postgres(?:ql)?|mysql|redis|mongodb(?:\+srv)?|amqp|smtp|mssql):\/\/[^\s'"@:/]+:([A-Za-z0-9_+/=~.!@#$%^&*?:-]{4,})@/,
+    true,
   ],
 ]
 
@@ -43,8 +50,12 @@ const trackedFiles = execSync('git ls-files', { encoding: 'utf8' })
   .split('\n')
   .filter(Boolean)
 
+// 剪藏目录是第三方教程的冻结导入格式（阶段 3 边界），其中的示例凭据不是本库的
+const SKIP_PREFIXES = ['.obsidian/', '04_Archive/Inbox-Clippings/']
+
 for (const file of trackedFiles) {
   if (file === '.scripts/verify-vault.mjs') continue
+  if (SKIP_PREFIXES.some((p) => file.startsWith(p))) continue
 
   if (file.endsWith('.png') || file.endsWith('.jpg') || file.endsWith('.jpeg') || file.endsWith('.gif') || file.endsWith('.webp') || file.endsWith('.svg') || file.endsWith('.ico') || file.endsWith('.woff') || file.endsWith('.woff2') || file.endsWith('.ttf') || file.endsWith('.eot') || file.endsWith('.pdf') || file.endsWith('.zip') || file.endsWith('.gz') || file.endsWith('.tar') || file.endsWith('.mp4') || file.endsWith('.mp3') || file.endsWith('.wav')) {
     continue
@@ -58,20 +69,17 @@ for (const file of trackedFiles) {
   }
 
   const lines = content.split('\n')
-  // .obsidian/** 是第三方插件代码与状态，值形态规则误报极高（minified JS/CSS）；
-  // 密钥载体 data.json 已解除跟踪，这里只保留 64 位 hex 检查
-  const isObsidian = file.startsWith('.obsidian/')
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i]
 
-    if (!isObsidian) {
+    if (!file.startsWith('.obsidian/')) {
       for (const [name, pattern, checkValue] of KEY_PATTERNS) {
         const m = pattern.exec(line)
         if (!m) continue
-        // 赋值类：值是占位符 / 环境引用时放行
+        // 赋值类：值是占位符 / 环境引用 / 默认口令时放行
         if (checkValue) {
           const value = m[1]
-          if (!value || PLACEHOLDER.test(value)) continue
+          if (!value || PLACEHOLDER.test(value) || DEFAULT_VALUES.test(value) || DEFAULT_SUFFIX.test(value) || CONFIG_NAME.test(value)) continue
         }
         console.error(`KEY LEAK (${name}): ${file}:${i + 1}`)
         found = true
diff --git a/.zcode/plans/plan-sess_0cc98e77-f1eb-421d-9514-7ef2591a7320.md b/.zcode/plans/plan-sess_0cc98e77-f1eb-421d-9514-7ef2591a7320.md
index f58872b..d2fba47 100644
--- a/.zcode/plans/plan-sess_0cc98e77-f1eb-421d-9514-7ef2591a7320.md
+++ b/.zcode/plans/plan-sess_0cc98e77-f1eb-421d-9514-7ef2591a7320.md
@@ -15,7 +15,7 @@
      "command": "uvx",
      "args": ["plane-mcp-server", "stdio"],
      "env": {
-       "PLANE_API_KEY": "plane_api_d3dd7b29c3d04f6190f7bcf9fda078f3",
+       "PLANE_API_KEY": "{{SECRET_PLANE_API}}",
        "PLANE_WORKSPACE_SLUG": "space",
        "PLANE_BASE_URL": "https://plane.chans.xyz"
      }
diff --git a/01_Projects/AI-Development/Claw.md b/01_Projects/AI-Development/Claw.md
index 303dc46..3f48217 100644
--- a/01_Projects/AI-Development/Claw.md
+++ b/01_Projects/AI-Development/Claw.md
@@ -148,18 +148,18 @@ WantedBy=multi-user.target
 telegram bot token
 windyclaw_bot
 ```
-8613374595:AAEZm_kCb_N9WDmRh5pXTBIZsKP_yI5vak8
+{{SECRET_TELEGRAM_WINDYCLAW_BOT}}
 ```
 
 
 ```
-curl -sS "https://api.telegram.org/bot8613374595:AAEZm_kCb_N9WDmRh5pXTBIZsKP_yI5vak8/getUpdates"
+curl -sS "https://api.telegram.org/bot{{SECRET_TELEGRAM_WINDYCLAW_BOT}}/getUpdates"
 ```
 
 
 ```
 [channels_config.telegram]
-bot_token = "8613374595:AAEZm_kCb_N9WDmRh5pXTBIZsKP_yI5vak8"
+bot_token = "{{SECRET_TELEGRAM_WINDYCLAW_BOT}}"
 allowed_users = ["203688083"]
 ```
 
@@ -176,7 +176,7 @@ smtp_port = 465
 smtp_tls = true
 
 username = "claw@windy.me"
-password = "F9h2INnnT$L4l9wQ"
+password = "{{SECRET_CLAW_EMAIL_CLAW_WINDY_ME}}"
 from_address = "claw@windy.me"
 
 poll_interval_secs = 60
diff --git a/01_Projects/Home-Automation/Storage.md b/01_Projects/Home-Automation/Storage.md
index c546c33..edf030b 100644
--- a/01_Projects/Home-Automation/Storage.md
+++ b/01_Projects/Home-Automation/Storage.md
@@ -11,7 +11,7 @@ GRANT ALL PRIVILEGES ON DATABASE hass TO hass;
 
 ```
 recorder:
-  db_url: postgresql://hass:hass@store.local/hass
+  db_url: postgresql://hass:{{SECRET_HA_DB_HASS}}@store.local/hass
 ```
 
 
@@ -113,7 +113,7 @@ Migrating your Home Assistant instance from SQLite to PostgreSQL involves a few
     ```lisp
 LOAD DATABASE
      FROM sqlite://./home-assistant_v2.db.bak
-     INTO postgresql://hass:hass@localhost/hass
+     INTO postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
 
  WITH data only,
       drop indexes,
@@ -156,7 +156,7 @@ ALTER SCHEMA "main" RENAME TO "public";
     
     ```yaml
     recorder:
-      db_url: postgresql://hass:hass@192.168.55.53/hass
+      db_url: postgresql://hass:{{SECRET_HA_DB_HASS}}@192.168.55.53/hass
     ```
     
     Replace `yourpassword` and `localhost` as needed.
@@ -260,7 +260,7 @@ psql -h localhost -U hass -d hass -f ha_dump.sql -W > load.log 2>&1
 
 
 ```
-pgloader sqlite://./home-assistant_v2.db.bak postgresql://hass:hass@localhost/hass
+pgloader sqlite://./home-assistant_v2.db.bak postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
 ```
 
 
@@ -298,7 +298,7 @@ SELECT setval('statistics_short_term_id_seq', MAX(id)) FROM statistics_short_ter
 
 ```
 recorder:
-  db_url: postgresql://hass:hass@192.168.55.53/hass
+  db_url: postgresql://hass:{{SECRET_HA_DB_HASS}}@192.168.55.53/hass
 ```
 
 
@@ -331,7 +331,7 @@ sqlite3mysql --sqlite-file home-assistant_v2.db --mysql-user hass --mysql-passwo
 
 ```
 recorder:
-  db_url: mysql://hass:hass@192.168.55.53/hass?charset=utf8mb4
+  db_url: mysql://hass:{{SECRET_HA_DB_HASS}}@192.168.55.53/hass?charset=utf8mb4
 
 ```
 
diff --git a/01_Projects/Home-Automation/WAQI.md b/01_Projects/Home-Automation/WAQI.md
index 10e49e2..c28f198 100644
--- a/01_Projects/Home-Automation/WAQI.md
+++ b/01_Projects/Home-Automation/WAQI.md
@@ -8,13 +8,13 @@ Congratulation, your registration already validated.
   
 Your token is
 
-761ba9c8b1745baed8d667f036d6ab46a843b962
+{{SECRET_WAQI_TOKEN}}
 
   
   
 
 You can now try, for instance, to get the beijing feed using:  
-[https://api.waqi.info/feed/here/?token=761ba9c8b1745baed8d667f036d6ab46a843b962](https://api.waqi.info/feed/here/?token=761ba9c8b1745baed8d667f036d6ab46a843b962)
+[https://api.waqi.info/feed/here/?token={{SECRET_WAQI_TOKEN}}](https://api.waqi.info/feed/here/?token={{SECRET_WAQI_TOKEN}})
 
 And you will get this result:
 
diff --git a/01_Projects/Home-Automation/data.md b/01_Projects/Home-Automation/data.md
index 1fda692..6e65ee4 100644
--- a/01_Projects/Home-Automation/data.md
+++ b/01_Projects/Home-Automation/data.md
@@ -46,7 +46,7 @@ Create a pgloader configuration file to handle the dump file import. Here's an e
 ```lisp
 LOAD DATABASE
     FROM FILE 'hass.sql'
-    INTO postgresql://hass:hass@localhost/hass
+    INTO postgresql://hass:{{SECRET_HA_DB_HASS}}@localhost/hass
 
 WITH include no drop, create tables, create indexes, reset sequences
 
diff --git a/01_Projects/Infrastructure/Services/Dendrite.md b/01_Projects/Infrastructure/Services/Dendrite.md
index c29ce9f..1de5283 100644
--- a/01_Projects/Infrastructure/Services/Dendrite.md
+++ b/01_Projects/Infrastructure/Services/Dendrite.md
@@ -7,12 +7,12 @@ dendrite/windyboy2006
 
 reCAPTCHA
 key: 6LemvrUlAAAAAPqUuH_1V-lWdKAeEORzeAEhor46
-secret: 6LemvrUlAAAAAOzHkBnRH3Qxiw2q3YI0ZHdLf6Bh
+secret: {{SECRET_DENDRITE_RECAPTCHA_SECRET}}
 
 admin:
-windy/catalog@2006
+windy / {{SECRET_DENDRITE_ADMIN}}（实际值见 Vaultwarden）
 
-AccessToken: D0lJWbpHRSO4s3zfqxSvO9ZmdWJuV2iPTC5K9VijuuU
+AccessToken: {{SECRET_DENDRITE_ACCESS_TOKEN}}
 
 
 matrix media repo:
diff --git a/01_Projects/Infrastructure/Services/Matrix-windy-pc.md b/01_Projects/Infrastructure/Services/Matrix-windy-pc.md
index 7fe2804..ba1b154 100644
--- a/01_Projects/Infrastructure/Services/Matrix-windy-pc.md
+++ b/01_Projects/Infrastructure/Services/Matrix-windy-pc.md
@@ -173,10 +173,10 @@ database:
     cp_max: 10
 log_config: "/data/chans.xyz.log.config"
 media_store_path: /data/media_store
-registration_shared_secret: "lTjbS&oVJ7==Co+4YdbDxR,u7.:d+3qgofIR@9c#*1ULc;M2,*"
+registration_shared_secret: "{{SECRET_MATRIX_CHANS_REGISTRATION_SHARED_SECRET}}"
 report_stats: true
-macaroon_secret_key: "fe@vZvVnFFA3j:;hK;DI27;vZk@lHHk~w7foB*Q0D0nd.;tGho"
-form_secret: "G*bdHINrFR+@,A3^P=IpayYU3aluiAKcI5@L&E-f#Du:s@MgB6"
+macaroon_secret_key: "{{SECRET_MATRIX_CHANS_MACAROON}}"
+form_secret: "{{SECRET_MATRIX_CHANS_FORM_SECRET}}"
 signing_key_path: "/data/chans.xyz.signing.key"
 trusted_key_servers:
   - server_name: "matrix.org"
@@ -205,7 +205,7 @@ EsT1 s6mK hgBT 3Cnv iYbW SNBD Bf3C LwPs nPbq dXJ8 cbbg aiEs
 matrix:
   homeserver: https://chans.xyz
   username: "@zhiqiang:chans.xyz"
-  password: "vaz6PQV5vjg1aya-mvr"
+  password: "{{SECRET_MATRIX_USER_ZHIQIANG}}"
   rooms:
     - "#hass:chans.xyz"
   commands:
@@ -251,7 +251,7 @@ get token
 curl -X POST -H "Content-Type: application/json" -d '{
   "type": "m.login.password",
   "user": "hass",
-  "password": ".P.fPdJL6.wz77q*9VjD"
+  "password": "{{SECRET_MATRIX_USER_HASS}}"
 }' "https://chans.xyz/_matrix/client/r0/login"
 
 ```
@@ -272,26 +272,26 @@ curl -XPOST "https://synapse.chans.xyz/_matrix/client/v3/login" \
              "type": "m.id.user",
              "user": "zhiqiang"
          },
-         "password": "vaz6PQV5vjg1aya-mvr"
+         "password": "{{SECRET_MATRIX_USER_ZHIQIANG}}"
      }'
 
 ```
 
 ```
 
-{"access_token":"mct_yDGcVmMw2QyTiPPq4DVEHr5BPjQeqh_w1qQx1","device_id":"MryevHEy6k","user_id":"@zhiqiang:chans.xyz"}%
+{"access_token":"{{SECRET_MATRIX_MCT_ACCESS_TOKEN}}","device_id":"MryevHEy6k","user_id":"@zhiqiang:chans.xyz"}%
 
 ```
 
 ```
-mct_yDGcVmMw2QyTiPPq4DVEHr5BPjQeqh_w1qQx1
+{{SECRET_MATRIX_MCT_ACCESS_TOKEN}}
 ```
 
 
 ```
 matrix:
   homeserver: chans.xyz
-  secret: 'wqfJ1r4cyaQbRNzGUUxjOyFf1g2hvC8F'
+  secret: '{{SECRET_MATRIX_WINDY_PC}}'
   endpoint: https://synapse.chans.xyz/
 
 ```
diff --git a/01_Projects/Infrastructure/Services/Matrix.md b/01_Projects/Infrastructure/Services/Matrix.md
index 9b2b776..5d29c42 100644
--- a/01_Projects/Infrastructure/Services/Matrix.md
+++ b/01_Projects/Infrastructure/Services/Matrix.md
@@ -173,10 +173,10 @@ database:
     cp_max: 10
 log_config: "/data/chans.xyz.log.config"
 media_store_path: /data/media_store
-registration_shared_secret: "lTjbS&oVJ7==Co+4YdbDxR,u7.:d+3qgofIR@9c#*1ULc;M2,*"
+registration_shared_secret: "{{SECRET_MATRIX_CHANS_REGISTRATION_SHARED_SECRET}}"
 report_stats: true
-macaroon_secret_key: "fe@vZvVnFFA3j:;hK;DI27;vZk@lHHk~w7foB*Q0D0nd.;tGho"
-form_secret: "G*bdHINrFR+@,A3^P=IpayYU3aluiAKcI5@L&E-f#Du:s@MgB6"
+macaroon_secret_key: "{{SECRET_MATRIX_CHANS_MACAROON}}"
+form_secret: "{{SECRET_MATRIX_CHANS_FORM_SECRET}}"
 signing_key_path: "/data/chans.xyz.signing.key"
 trusted_key_servers:
   - server_name: "matrix.org"
@@ -205,7 +205,7 @@ EsT1 s6mK hgBT 3Cnv iYbW SNBD Bf3C LwPs nPbq dXJ8 cbbg aiEs
 matrix:
   homeserver: https://chans.xyz
   username: "@zhiqiang:chans.xyz"
-  password: "vaz6PQV5vjg1aya-mvr"
+  password: "{{SECRET_MATRIX_USER_ZHIQIANG}}"
   rooms:
     - "#hass:chans.xyz"
   commands:
@@ -251,7 +251,7 @@ get token
 curl -X POST -H "Content-Type: application/json" -d '{
   "type": "m.login.password",
   "user": "hass",
-  "password": ".P.fPdJL6.wz77q*9VjD"
+  "password": "{{SECRET_MATRIX_USER_HASS}}"
 }' "https://chans.xyz/_matrix/client/r0/login"
 
 ```
@@ -297,7 +297,7 @@ No email address provided, user will be prompted to add one
 matrix:
   homeserver: "https://chans.xyz"
   username: "@hass:chans.xyz"
-  password: "sgHoMmOWn8SkYJf#"
+  password: "{{SECRET_MATRIX_USER_HASS}}"
   rooms:
     - "#guangzhou:chans.xyz"
 
diff --git a/01_Projects/Infrastructure/VPS/DNS.md b/01_Projects/Infrastructure/VPS/DNS.md
index 61e3db4..fbcd4fd 100644
--- a/01_Projects/Infrastructure/VPS/DNS.md
+++ b/01_Projects/Infrastructure/VPS/DNS.md
@@ -350,7 +350,7 @@ docker compose exec -T db psql \
 
 ```
 docker compose exec -T db psql -U pdns -d postgres -v ON_ERROR_STOP=1 
-  -c "ALTER ROLE pdnsadmin WITH PASSWORD 'windyboy2006';"
+  -c "ALTER ROLE pdnsadmin WITH PASSWORD '{{SECRET_PDNSADMIN_DB}}';"
 ```
 
 
diff --git a/01_Projects/Personal-Tech/LLM_Evaluation/04-Reference/evaluation-guidebook/06-Yearly-Dives.md b/01_Projects/Personal-Tech/LLM_Evaluation/04-Reference/evaluation-guidebook/06-Yearly-Dives.md
index 520067e..f732433 100644
--- a/01_Projects/Personal-Tech/LLM_Evaluation/04-Reference/evaluation-guidebook/06-Yearly-Dives.md
+++ b/01_Projects/Personal-Tech/LLM_Evaluation/04-Reference/evaluation-guidebook/06-Yearly-Dives.md
@@ -91,7 +91,7 @@ source: https://github.com/huggingface/evaluation-guidebook
 - **Pythia**（EleutherAI，[论文 2304.01373](https://huggingface.co/papers/2304.01373)）：不同尺寸的[模型套件](https://huggingface.co/collections/EleutherAI/pythia-scaling-suite-64fb5dfa8c21ebb3db7ad2e1)，完全公开数据训练，用于研究 LLM 训练各阶段。
 - **MPT**（MosaicML，[博客](https://www.mosaicml.com/blog/mpt-7b)）：性能接近但**许可证允许商用**，且公开训练数据构成。首个 [7B](https://huggingface.co/mosaicml/mpt-7b)，6 月跟进 30B，均 1T token（C4、CommonCrawl、The Stack、S2ORC）。
 - **Falcon**（TIIUAE）：[7B/30B](https://huggingface.co/tiiuae/falcon-7b)，1–1.5T token 英语与代码（RefinedWeb、Project Gutenberg、Reddit、StackOverflow、GitHub、arXiv、Wikipedia 等），年底发布 180B。数据与训练流程有技术报告及[后续论文 2311.16867](https://huggingface.co/papers/2311.16867)。
-- **StableLM**（StabilityAI）：继承 GPT-NeoX，3B/7B，1.5T token（ThePile 实验数据集）；v2 系列混入 RefinedWeb、RedPajama、ThePile 及未公开数据；另有 3B 的 [StableLM-3B-4e1T](https://huggingface.co/stabilityai/stablelm-3b-4e1t) + [详细技术报告](https://stability.wandb.io/stability-llm/stable-lm/reports/StableLM-3B-4E1T--VmlldzoyMjU4?accessToken=u3zujipenkx5g7rtcj9qojjgxpconyjktjkli2po09nffrffdhhchq045vp0wyfo)。
+- **StableLM**（StabilityAI）：继承 GPT-NeoX，3B/7B，1.5T token（ThePile 实验数据集）；v2 系列混入 RefinedWeb、RedPajama、ThePile 及未公开数据；另有 3B 的 [StableLM-3B-4e1T](https://huggingface.co/stabilityai/stablelm-3b-4e1t) + [详细技术报告](https://stability.wandb.io/stability-llm/stable-lm/reports/StableLM-3B-4E1T--VmlldzoyMjU4?accessToken=REDACTED（第三方分享链接的访问令牌，原文已失效处理）)。
 - **转折点**：早期发布公开数据；此后发布几乎**不提供训练数据信息、不可复现**，但通过权重为社区提供起点。
 - **X-Gen**（Salesforce，[论文 2309.03450](https://huggingface.co/papers/2309.03450)）：7B，1.5T token "natural language and code"，分步训练 + 数据调度（不是所有数据同时进入）。
 - **LLaMA-2**（Meta，[论文 2307.09288](https://huggingface.co/papers/2307.09288)）：7–70B，2T token "公开来源"，permissive 社区许可证 + 大规模 RLHF 人类偏好微调（alignment）。安全是突出卖点。
diff --git a/01_Projects/Work/Government-Projects/Document-Exchange/dm database usage.md b/01_Projects/Work/Government-Projects/Document-Exchange/dm database usage.md
index 9957ff2..31701e6 100644
--- a/01_Projects/Work/Government-Projects/Document-Exchange/dm database usage.md	
+++ b/01_Projects/Work/Government-Projects/Document-Exchange/dm database usage.md	
@@ -3,9 +3,9 @@ created: 2026-06-25
 title: dm database usage
 date: 2026-05-22
 vpn_username: gwjhgzzn
-vpn_password: Pygwjh@202409
-102-password: 102GZgw$jH1170510M
-107-password: zwdC1PhH63Zh
+vpn_password: {{SECRET_WORK_DM_VPN_GWJHGZZN}}（实际值见 Vaultwarden）
+102-password: {{SECRET_WORK_DM_102}}
+107-password: {{SECRET_WORK_DM_107}}
 db-user: PYGWJH
 db-pass: Gwjh@2021
 ---
diff --git a/01_Projects/Work/Government-Projects/Industry-Info/Handling-MacBook-Pro.md b/01_Projects/Work/Government-Projects/Industry-Info/Handling-MacBook-Pro.md
index 1c30ba3..828e911 100644
--- a/01_Projects/Work/Government-Projects/Industry-Info/Handling-MacBook-Pro.md
+++ b/01_Projects/Work/Government-Projects/Industry-Info/Handling-MacBook-Pro.md
@@ -298,7 +298,7 @@ docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endp
 
 
 ```
-docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
+docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="{{SECRET_WORK_ETCD_ROOT}}"
 ```
 
 
diff --git a/01_Projects/Work/Government-Projects/Industry-Info/Handling.md b/01_Projects/Work/Government-Projects/Industry-Info/Handling.md
index 3216db0..d82d500 100644
--- a/01_Projects/Work/Government-Projects/Industry-Info/Handling.md
+++ b/01_Projects/Work/Government-Projects/Industry-Info/Handling.md
@@ -298,7 +298,7 @@ docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endp
 
 
 ```
-docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
+docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="{{SECRET_WORK_ETCD_ROOT}}"
 ```
 
 
diff --git a/01_Projects/Work/Government-Projects/Industry-Info/PERCONA XTRADB CLUSTER.md b/01_Projects/Work/Government-Projects/Industry-Info/PERCONA XTRADB CLUSTER.md
index 68ce3a0..1804179 100644
--- a/01_Projects/Work/Government-Projects/Industry-Info/PERCONA XTRADB CLUSTER.md	
+++ b/01_Projects/Work/Government-Projects/Industry-Info/PERCONA XTRADB CLUSTER.md	
@@ -133,7 +133,7 @@ wc97fjvDg:Ywgyad
 gzii-db-3:
 ```bash
 docker run -d \
-  -e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
+  -e MYSQL_ROOT_PASSWORD={{SECRET_WORK_PXC_MYSQL_ROOT}} \
   -e CLUSTER_NAME=pxc-cluster1 \
   --name=gzii-db-3 \
   --net=host \
@@ -146,7 +146,7 @@ docker run -d \
 gzii-db-4:
 ```bash
 docker run -d \
-  -e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
+  -e MYSQL_ROOT_PASSWORD={{SECRET_WORK_PXC_MYSQL_ROOT}} \
   -e CLUSTER_NAME=pxc-cluster1 \
   -e CLUSTER_JOIN=gzii-db-3 \
   --name=gzii-db-4 \
diff --git a/02_Areas/GFW/Bills.md b/02_Areas/GFW/Bills.md
index ef1e43b..21545f3 100644
--- a/02_Areas/GFW/Bills.md
+++ b/02_Areas/GFW/Bills.md
@@ -14,7 +14,7 @@ https://laomaoyun.me/
 于 2023/04/15 到期，距离到期还有 31 天
 30元
 
-https://09.laomao1.xyz/api/v1/client/subscribe?token=daddf8de9b1e002478b6fc59a6760e85
+https://09.laomao1.xyz/api/v1/client/subscribe?token={{SECRET_VPN_LAOMAO1_SUBSCRIBE}}
 
 
 
@@ -77,7 +77,7 @@ https://subapi1.gardenparty.one/link/7662I1Snxww7zkgq?sub=3
 150g/14月
 
 https://dog1.ssrdog111.com/
-https://host.api-baobaog.rest/api/v1/client/subscribe?token=ab911d53f4ef8abb40da6fd6c5ab326d
+https://host.api-baobaog.rest/api/v1/client/subscribe?token={{SECRET_VPN_SSRDOG_SUBSCRIBE}}
 
 
 
diff --git a/02_Areas/Network & VPN/VPN-Subscriptions.md b/02_Areas/Network & VPN/VPN-Subscriptions.md
index 2f2d223..9ea9c57 100644
--- a/02_Areas/Network & VPN/VPN-Subscriptions.md	
+++ b/02_Areas/Network & VPN/VPN-Subscriptions.md	
@@ -13,7 +13,7 @@ https://laomaoyun.me/
 于 2023/04/15 到期，距离到期还有 31 天
 30元
 
-https://09.laomao1.xyz/api/v1/client/subscribe?token=daddf8de9b1e002478b6fc59a6760e85
+https://09.laomao1.xyz/api/v1/client/subscribe?token={{SECRET_VPN_LAOMAO1_SUBSCRIBE}}
 
 
 
@@ -76,7 +76,7 @@ https://subapi1.gardenparty.one/link/7662I1Snxww7zkgq?sub=3
 150g/14月
 
 https://dog1.ssrdog111.com/
-https://host.api-baobaog.rest/api/v1/client/subscribe?token=ab911d53f4ef8abb40da6fd6c5ab326d
+https://host.api-baobaog.rest/api/v1/client/subscribe?token={{SECRET_VPN_SSRDOG_SUBSCRIBE}}
 
 
 
diff --git a/02_Areas/Personal Development/remark42.md b/02_Areas/Personal Development/remark42.md
index 7cf0eda..b81b499 100644
--- a/02_Areas/Personal Development/remark42.md	
+++ b/02_Areas/Personal Development/remark42.md	
@@ -32,5 +32,5 @@ ADMIN_SHARED_ID=github_20924f5ace2e27ff9b98801b837b8a495308d782
 
 ```text-plain
 NOTIFY_TYPE=telegram
-NOTIFY_TELEGRAM_TOKEN=1312138212:AAFhKNaLXTT1-cqPrcOiLTLKr3656uviRLE
+NOTIFY_TELEGRAM_TOKEN={{SECRET_TELEGRAM_REMARK42_BOT}}
 ```
\ No newline at end of file
diff --git a/03_Resources/Development/AI-ML/Azure-config.md b/03_Resources/Development/AI-ML/Azure-config.md
index 4476946..20af219 100644
--- a/03_Resources/Development/AI-ML/Azure-config.md
+++ b/03_Resources/Development/AI-ML/Azure-config.md
@@ -2,11 +2,11 @@
 created: 2026-01-05
 ---
 
-key : 272f337c0d2c4407b930bde5e9846072
+key : {{SECRET_AZURE_OPENAI_MYCHATGPT}}（实际值见 Vaultwarden）
 endpoint: https://my-chatgpt.openai.azure.com/
 
 ```bash
-export AZURE_OPENAI_API_KEY="272f337c0d2c4407b930bde5e9846072"
+export AZURE_OPENAI_API_KEY="{{SECRET_AZURE_OPENAI_MYCHATGPT}}"
 export AZURE_OPENAI_ENDPOINT="https://my-chatgpt.openai.azure.com/"
 ```
 ```
@@ -14,7 +14,7 @@ export AZURE_OPENAI_ENDPOINT="https://my-chatgpt.openai.azure.com/"
 ```.env
 # ChatGPT Settings (required)
 # Set the API Key from OpenAI
-OPENAI_API_KEY=272f337c0d2c4407b930bde5e9846072
+OPENAI_API_KEY={{SECRET_AZURE_OPENAI_MYCHATGPT}}
 # To use Azure OpenAI API, set `OPENAI_AZURE` to true and `CHATGPT_REVERSE_PROXY` to your completion endpoint
 # OPENAI_AZURE=false
 OPENAI_AZURE=true
diff --git a/03_Resources/Development/AI-ML/Nvidia-config.md b/03_Resources/Development/AI-ML/Nvidia-config.md
index 9caed98..a293569 100644
--- a/03_Resources/Development/AI-ML/Nvidia-config.md
+++ b/03_Resources/Development/AI-ML/Nvidia-config.md
@@ -11,7 +11,7 @@ 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
 use glm 4.7
 ```bash
 export ANTHROPIC_BASE_URL=http://localhost:3001
-export ANTHROPIC_AUTH_TOKEN=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
+export ANTHROPIC_AUTH_TOKEN=nvapi-{{SECRET_NVIDIA_API_KEY}}（实际值见 Vaultwarden）
 export ANTHROPIC_DEFAULT_HAIKU_MODEL=z-ai/glm4.7
 export ANTHROPIC_DEFAULT_SONNET_MODEL=z-ai/glm4.7
 export ANTHROPIC_DEFAULT_OPUS_MODEL=z-ai/glm4.7
diff --git a/03_Resources/Development/AI-ML/Zenmux-config.md b/03_Resources/Development/AI-ML/Zenmux-config.md
index fe3b35e..42e32af 100644
--- a/03_Resources/Development/AI-ML/Zenmux-config.md
+++ b/03_Resources/Development/AI-ML/Zenmux-config.md
@@ -5,7 +5,7 @@ created: 2026-01-05
 
 coder ：
 ```
-sk-ai-v1-875cd41da6e117609e850e4c594d0116f2e128bee9bf6890eb6a48fe23e69764
+sk-ai-v1-{{SECRET_ZENMUX_CODER}}（实际值见 Vaultwarden）
 ```
 
 url:
@@ -23,12 +23,12 @@ https://zenmux.ai/api/vertex-ai
 
 obsidian:
 ```
-sk-ai-v1-82f1a2df15721ca5d5afc633842b91719fea95c6c449cbb78db0dd03f7ed1aa2
+sk-ai-v1-{{SECRET_ZENMUX_OBSIDIAN}}（实际值见 Vaultwarden）
 ```
 
 
 
 Clawdbot:
 ```
-sk-ai-v1-74be1c7baa2d45efcea213f3b3cfb7defc03c3e44044b26d9c289f32b156a199
+sk-ai-v1-{{SECRET_ZENMUX_CLAWDBOT}}（实际值见 Vaultwarden）
 ```
\ No newline at end of file
diff --git a/03_Resources/Development/AI-ML/mcp-config.md b/03_Resources/Development/AI-ML/mcp-config.md
index b530f65..ac8f079 100644
--- a/03_Resources/Development/AI-ML/mcp-config.md
+++ b/03_Resources/Development/AI-ML/mcp-config.md
@@ -5,6 +5,6 @@ created: 2026-01-05
 
 context7 mcp key:
 ```
-ctx7sk-92c2c98e-817e-41d4-bb85-94824444e2bf
+ctx7sk-{{SECRET_CONTEXT7_MCP}}（实际值见 Vaultwarden）
 ```
 
diff --git a/03_Resources/Prompt-Library/baibot-system-prompts.md b/03_Resources/Prompt-Library/baibot-system-prompts.md
index a33b25a..d4fe2e3 100644
--- a/03_Resources/Prompt-Library/baibot-system-prompts.md
+++ b/03_Resources/Prompt-Library/baibot-system-prompts.md
@@ -108,7 +108,7 @@ text_generation:
 
 ```yaml
 base_url: https://zenmux.ai/api/v1
-api_key: sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03
+api_key: sk-ai-v1-{{SECRET_ZENMUX_BAIBOT}}（实际值见 Vaultwarden）
 
 text_generation:
   model_id: moonshotai/kimi-k2-thinking
@@ -219,7 +219,7 @@ text_generation:
 
 ```yaml
 base_url: https://zenmux.ai/api/v1
-api_key: sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03
+api_key: sk-ai-v1-{{SECRET_ZENMUX_BAIBOT}}（实际值见 Vaultwarden）
 
 text_generation:
   model_id: google/gemini-3-pro-preview-free
@@ -279,7 +279,7 @@ speech_to_text:
 
 ```yaml
 base_url: https://zenmux.ai/api/v1
-api_key: sk-ai-v1-2d2ba59719ff6f0d8d2f439d3b5c84399176d1059302cc4b43c132a4d17e9f03
+api_key: sk-ai-v1-{{SECRET_ZENMUX_BAIBOT}}（实际值见 Vaultwarden）
 
 text_generation:
   model_id: deepseek/deepseek-v3.2-speciale
diff --git a/04_Archive/Projects/Airport/Dev Env.md b/04_Archive/Projects/Airport/Dev Env.md
index d800c89..f8fae47 100644
--- a/04_Archive/Projects/Airport/Dev Env.md	
+++ b/04_Archive/Projects/Airport/Dev Env.md	
@@ -2,17 +2,11 @@
 主机名：xjc-app
 账号：devman
 登录方式：密钥id_devman
-账号密码：Ipower2024
+账号密码：{{SECRET_XJC_APP_DEVMAN}}（实际值见 Vaultwarden）
 IP：10.100.101.186（动态IP）
 
 ```id_devman
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-QyNTUxOQAAACBIahgzOtvIiFs9sYakfuvDBVDyWTOpJ2mFJ9UHKTWPOwAAAJCr8Cxoq/As
-aAAAAAtzc2gtZWQyNTUxOQAAACBIahgzOtvIiFs9sYakfuvDBVDyWTOpJ2mFJ9UHKTWPOw
-AAAEBBdD+wjI107ItWAvtejiFNF9fpXXn4kj9PKyzEguRwEkhqGDM628iIWz2xhqR+68MF
-UPJZM6knaYUn1QcpNY87AAAAC2Rldm1hbkBnenpuAQI=
------END OPENSSH PRIVATE KEY-----
+{{SECRET_SSH_ID_DEVMAN}}（完整 OpenSSH 私钥已移入 Vaultwarden「xjc-app / id_devman」条目，本文件不再保存正文）
 ```
 
 ```