From 32987f7acecbd5f6bd8a02506a4cc814cd8d94d2 Mon Sep 17 00:00:00 2001
From: Abner <22141172+Silentely@users.noreply.github.com>
Date: Fri, 26 Jun 2026 21:38:44 +0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=93=9D=20docs:=20=E6=9B=B4=E6=96=B0?=
 =?UTF-8?q?=E5=BC=80=E5=8F=91=E5=91=BD=E4=BB=A4=E4=B8=8E=E6=96=87=E6=A1=A3?=
 =?UTF-8?q?=E9=93=BE=E6=8E=A5=EF=BC=8C=E4=BF=AE=E5=A4=8D=E5=AE=89=E5=85=A8?=
 =?UTF-8?q?=E6=96=87=E6=A1=A3=E5=88=97=E8=A1=A8=E6=A0=BC=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 将开发启动命令从 `npm start` 改为 `npm run dev`，使命令与实际脚本一致
- 替换技术参考文档链接：移除架构说明、Giffgaff/Simyo技术参考及CORS解决方案，新增通知系统指南和安全指南
- 更新开发者文档引用，引导用户查看新的通知系统和安全指南
- 修复 SECURITY.md 中已知漏洞修复项的列表格式，将 emoji 改为 `[x]` 复选框表示已完成
- 为 SECURITY.md 中 Helmet 示例补充 CommonJS 模块系统的注释说明
---
 README.md        | 10 ++++------
 README_EN.md     | 12 +++++-------
 docs/SECURITY.md | 15 ++++++++-------
 3 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/README.md b/README.md
index d257c28..f33db78 100644
--- a/README.md
+++ b/README.md
@@ -199,7 +199,7 @@ cp env.example .env
 # 编辑 .env 填写必要配置
 
 # 4. 启动开发服务器
-npm start
+npm run dev
 
 # 5. 访问 http://localhost:3000
 ```
@@ -230,10 +230,8 @@ npm start
   - [Giffgaff 使用教程](./docs/User_Guide.md) | [English](./docs/User_Guide_EN.md)
 
 - **技术参考**（开发者）
-  - [架构说明](./docs/ARCHITECTURE.md)
-  - [Giffgaff 技术参考](./docs/reference/README_giffgaff_esim.md) | [English](./docs/reference/README_giffgaff_esim_EN.md)
-  - [Simyo 技术参考](./docs/reference/README_simyo_esim.md) | [English](./docs/reference/README_simyo_esim_EN.md)
-  - [CORS 解决方案](./docs/guides/CORS_SOLUTION.md)
+  - [通知系统使用指南](./docs/guides/notification-system.md)
+  - [安全指南](./docs/SECURITY.md)
 
 ---
 
@@ -245,7 +243,7 @@ npm start
 - 📦 **离线可用** - 支持断网使用，网络波动不影响操作
 - 🎯 **现代标准** - PWA、Web Vitals 优化，移动端友好
 
-> 💻 **开发者文档**: 查看 [技术架构说明](./docs/ARCHITECTURE.md) 了解实现细节
+> 💻 **开发者文档**: 查看 [通知系统指南](./docs/guides/notification-system.md) 和 [安全指南](./docs/SECURITY.md)
 
 ---
 
diff --git a/README_EN.md b/README_EN.md
index 321c56d..aff6fbd 100644
--- a/README_EN.md
+++ b/README_EN.md
@@ -48,7 +48,7 @@ If you don't have a number yet, register through these links to get bonus credit
 - ✅ Have an existing Giffgaff number (UK carrier)
 - ✅ Want to switch from physical SIM to eSIM
 - ✅ Need to reactivate eSIM on a new device
-❌ New users registering a number (must obtain number through official or third-party channels first)
+- ❌ New users registering a number (must obtain number through official or third-party channels first)
 
 ### 🇳🇱 Simyo Users
 
@@ -199,7 +199,7 @@ cp env.example .env
 # Edit .env to fill in required configuration
 
 # 4. Start development server
-npm start
+npm run dev
 
 # 5. Visit http://localhost:3000
 ```
@@ -230,10 +230,8 @@ npm start
   - [Giffgaff User Guide](./docs/User_Guide_EN.md) | [中文](./docs/User_Guide.md)
 
 - **Technical Reference** (Developers)
-  - [Architecture](./docs/ARCHITECTURE.md)
-  - [Giffgaff Technical Reference](./docs/reference/README_giffgaff_esim_EN.md) | [中文](./docs/reference/README_giffgaff_esim.md)
-  - [Simyo Technical Reference](./docs/reference/README_simyo_esim_EN.md) | [中文](./docs/reference/README_simyo_esim.md)
-  - [CORS Solutions](./docs/guides/CORS_SOLUTION.md)
+  - [Notification System Guide](./docs/guides/notification-system.md)
+  - [Security Guide](./docs/SECURITY.md)
 
 ---
 
@@ -245,7 +243,7 @@ npm start
 - 📦 **Offline Ready** - Works offline, network fluctuations don't affect operations
 - 🎯 **Modern Standards** - PWA, Web Vitals optimized, mobile-friendly
 
-> 💻 **Developer Documentation**: See [Technical Architecture](./docs/ARCHITECTURE.md) for implementation details
+> 💻 **Developer Documentation**: See [Notification System Guide](./docs/guides/notification-system.md) and [Security Guide](./docs/SECURITY.md)
 
 ---
 
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 2b2a181..fdcc34e 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -14,12 +14,12 @@
 - 使用 `npm run security-check` 运行自定义安全检查
 
 #### 已知漏洞修复
-- ✅ tar-fs: 路径遍历漏洞已修复
-- ✅ got: UNIX socket重定向漏洞已修复
-- ✅ ipx: 路径遍历绕过漏洞已修复
-- ✅ http-proxy-middleware: writeBody重复调用漏洞已修复
-- ✅ esbuild: 开发服务器安全问题已修复
-- ✅ on-headers: HTTP响应头操作漏洞已修复
+- [x] tar-fs: 路径遍历漏洞已修复
+- [x] got: UNIX socket重定向漏洞已修复
+- [x] ipx: 路径遍历绕过漏洞已修复
+- [x] http-proxy-middleware: writeBody重复调用漏洞已修复
+- [x] esbuild: 开发服务器安全问题已修复
+- [x] on-headers: HTTP响应头操作漏洞已修复
 
 ### 2. 服务器安全
 
@@ -35,6 +35,7 @@
 
 #### Helmet安全头
 ```javascript
+// server.js 使用 Node.js CommonJS 模块系统
 const helmet = require('helmet');
 app.use(helmet());
 ```
@@ -56,7 +57,7 @@ app.use(cors({
 
 ### 3. 内容安全策略 (CSP)
 
-所有 HTML 文件都配置了严格的 CSP 策略。以下为本地开发服务器 (`server.js`) 中的 Helmet CSP 配置，生产环境通过 HTML `<meta>` 标签实现，具体值可能略有差异，请以 `server.js` 中的配置为参考基准：
+所有 HTML 文件都配置了严格的 CSP 策略。以下为本地开发服务器 (`server.js`) 中的 Helmet CSP 配示例（CommonJS 模块系统），生产环境通过 HTML `<meta>` 标签实现，具体值可能略有差异，请以 `server.js` 中的配置为参考基准：
 
 ```javascript
 app.use(helmet({