2026-04-20-10-14-09 - 安全加固：XOR→AES-GCM、API Key环境变量化、授权码SHA-256哈希、消除硬编码密钥

.env.example

@@ -7,3 +7,22 @@ GEMINI_API_KEY="MY_GEMINI_API_KEY"
 # AI Studio automatically injects this at runtime with the Cloud Run service URL.
 # Used for self-referential links, OAuth callbacks, and API endpoints.
 APP_URL="MY_APP_URL"
+
+# STORAGE_KEY: AES-GCM encryption key for localStorage systemSettings (max 32 chars used).
+# Must be set at build time. Leaving it empty will cause runtime initialization error.
+STORAGE_KEY="YourRandom32CharKeyHere!!!"
+
+# DEFAULT_API_KEY: Default AI provider API key, replaces the hardcoded API_KEY_CODES array.
+# Must be set at build time.
+DEFAULT_API_KEY="your-api-key-here"
+
+# ADMIN_AUTH_HASH: SHA-256 hex hash of (authorization_password + ADMIN_AUTH_SALT).
+# Used in UserManage.tsx to verify high-privilege disable operations.
+ADMIN_AUTH_HASH="your-sha256-hash-here"
+
+# ADMIN_AUTH_SALT: Salt used when computing the admin authorization SHA-256 hash.
+ADMIN_AUTH_SALT="your-random-salt-here"
+
+# LEGACY_STORAGE_KEY: Former XOR encryption key used to auto-migrate old localStorage data.
+# Set to the previous hardcoded value if you need backward compatibility.
+LEGACY_STORAGE_KEY="MedicalReportSys2024"