From a5c370018c0fd902de71e0944039c1a1b8f19da8 Mon Sep 17 00:00:00 2001
From: root <root@qq.com>
Date: Mon, 10 Aug 2026 11:53:14 +0800
Subject: [PATCH] docs: remind to rotate the admin key after first start (seed
 key lives in plaintext config.yaml)

---
 README.md           | 2 ++
 README_EN.md        | 4 ++++
 config.example.yaml | 2 ++
 3 files changed, 8 insertions(+)

diff --git a/README.md b/README.md
index 8fe6c48..79ec74a 100644
--- a/README.md
+++ b/README.md
@@ -118,6 +118,8 @@ sources:
 
 - `gateway_keys` 配置只是**初始 admin 密钥种子**：首次启动迁移为运行时 admin
   key，之后不再参与鉴权管理。
+- **重要：首次启动后请在 WebUI「密钥」页更换管理员密钥**——初始密钥明文写在
+  `config.yaml` 里，继续使用存在被盗风险；用新密钥登录后删除初始密钥。
 - WebUI **密钥页**可创建/删除密钥；每个密钥可指定 `admin`（管理全部）或
   `user`（仅看自己的 key）角色，并配置**模型范围**（模型 + 源 + token 配额 +
   重置周期）。
diff --git a/README_EN.md b/README_EN.md
index 3493959..d63c92c 100644
--- a/README_EN.md
+++ b/README_EN.md
@@ -142,6 +142,10 @@ under the `keys` field of the runtime file (encrypted at rest):
 
 - The `gateway_keys` config is only an **initial admin key seed** — it is
   migrated into the runtime store on first start and no longer drives auth.
+- **Important: after first start, replace the admin key via the WebUI Keys
+  page.** The seed key is written in plaintext in `config.yaml`, so keeping it
+  active is a security risk; create a new admin key, log in with it, then
+  delete the seed key.
 - The WebUI **Keys page** creates/deletes keys. Each key has a role (`admin`
   manages everything, `user` sees only its own key) and an optional **model
   scope** (model + source + token quota + reset period).
diff --git a/config.example.yaml b/config.example.yaml
index 1694247..23419de 100644
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -6,6 +6,8 @@ listen: 127.0.0.1:8080
 # 网关自身鉴权密钥。现在为「多密钥」架构：此项仅作为初始 admin 密钥种子，
 # 首次启动写入运行时存储（runtime_file 的 keys 字段，加密存储）。之后请在
 # WebUI「密钥」页创建、删除密钥并配置其模型范围。留空 = 首启无 admin 密钥。
+# 注意：首次启动后应立即在 WebUI 更换管理员密钥，并删除本初始种子——它明文
+# 写在配置文件里，存在被窃取风险。
 gateway_keys:
   - sk-gw-local-0001