本固件为了在隔离局域网中首次部署，包含临时弱初始凭据。安装后必须立即：

1. 修改 root 密码。
2. 安装专用 SSH 公钥。
3. 验证新密钥可登录后，禁用 SSH 密码登录。
4. 确认 LuCI 和 SSH 只从 LAN 侧可达。
5. 在启用 OpenClash、AdGuard Home、Docker 或 iStore 前审核其配置。

示例：

passwd root
uci set dropbear.@dropbear[0].PasswordAuth='off'
uci set dropbear.@dropbear[0].RootPasswordAuth='off'
uci commit dropbear
/etc/init.d/dropbear restart

请先保留一个已登录会话，再用第二个终端验证公钥登录，避免锁在设备外。

禁止提交：

• 私钥、Token、密码、设备验证码。
• 真实管理 IP、自定义 SSH 端口、MAC 和磁盘序列号。
• 代理订阅、节点、证书、Cookie 和应用 API 凭据。
• 包含真实账号名的绝对路径和原始日志。
• /etc/openclash/*.yaml、/etc/AdGuardHome.yaml、查询日志、支持包和完整配置备份。

提交前运行：

python3 scripts/audit-public-repo.py

请通过 GitHub Security Advisory 私下报告安全问题，不要在公开 Issue 中提交可利用细节或真实凭据。

The image contains a temporary weak credential for first-time deployment on an isolated, trusted LAN. Immediately after installation:

1. Change the root password.
2. Install a dedicated SSH public key.
3. Verify key login in a second terminal, then disable SSH password authentication.
4. Confirm that LuCI and SSH are reachable only from the LAN side.
5. Review configuration before enabling OpenClash, AdGuard Home, Docker, or iStore.

Keep one authenticated session open while testing key login from a second terminal to avoid locking yourself out.

Never commit private keys, tokens, passwords, device codes, real management addresses, custom SSH ports, MAC addresses, disk serials, proxy subscriptions, nodes, certificates, cookies, API credentials, user-specific absolute paths, or unredacted logs.

This also includes /etc/openclash/*.yaml, /etc/AdGuardHome.yaml, query logs, support bundles, and complete configuration backups. Before committing, run:

python3 scripts/audit-public-repo.py

Use a private GitHub Security Advisory. Do not publish exploitable details or real credentials in a public issue.