去掉公开 CAP 口硬编码默认密钥；SessionSecret 为空时拒绝签发/核销，防止未授权伪造 PoW。metric 持平 8。

Result: {"status":"keep","total_issues":8,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":1,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":8,"eslint_problems":0,"eslint_errors":0,"eslint_warnings":0,"tsc_errors":0,"measure_s":75,"golint_test_testifylint":0,"golint_test_thelper":0,"golint_test_usetesting":0,"golint_test_total":0,"golint_exhaustive":0,"golint_vetx_total":0,"vitest_failed":0,"vitest_total":126}

internal/apps/cap/manager.go

@@ -175,10 +175,13 @@ var (
 // GetDefaultManager yields the global singleton CAPTCHA manager.
 func GetDefaultManager() *Manager {
 	once.Do(func() {
-		secret := []byte("default-captcha-secret-key-at-least-16-bytes")
-		if config.Config != nil && config.Config.App.SessionSecret != "" {
+		var secret []byte
+		if config.Config != nil && strings.TrimSpace(config.Config.App.SessionSecret) != "" {
 			secret = []byte(config.Config.App.SessionSecret)
 		}
+		if len(secret) == 0 {
+			return
+		}
 
 		var store pkgcap.Store
 		if config.Config != nil && config.Config.Redis.Enabled && db.Redis != nil {

internal/apps/cap/middleware.go

@@ -16,6 +16,10 @@ func VerifyMiddleware(mgr *Manager, scope string) gin.HandlerFunc {
 			c.Next()
 			return
 		}
+		if mgr == nil {
+			response.AbortUnauthorized(c, errCapTokenInvalidOrExpired)
+			return
+		}
 
 		token := c.GetHeader("X-Cap-Token")
 		if token == "" {

internal/apps/cap/routers.go

@@ -43,6 +43,10 @@ func Challenge(c *gin.Context) {
 	}
 
 	mgr := GetDefaultManager()
+	if mgr == nil {
+		response.AbortInternal(c, "captcha is not configured")
+		return
+	}
 	resp, err := mgr.Generate(c.Request.Context(), req.Scope)
 	if err != nil {
 		response.AbortInternal(c, err.Error())
@@ -75,6 +79,10 @@ func Redeem(c *gin.Context) {
 	}
 
 	mgr := GetDefaultManager()
+	if mgr == nil {
+		response.AbortInternal(c, "captcha is not configured")
+		return
+	}
 	resp, err := mgr.Redeem(c.Request.Context(), req.Token, req.Solutions, req.Scope)
 	if err != nil {
 		response.AbortInternal(c, err.Error())

internal/apps/cap/routers_test.go

@@ -9,10 +9,12 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"sync"
 	"testing"
 
 	"github.com/gin-gonic/gin"
 
+	"github.com/Rain-kl/Wavelet/internal/infra/config"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/Rain-kl/Wavelet/internal/shared/response"
@@ -39,6 +41,15 @@ func TestCapEndpointsAndMiddleware(t *testing.T) {
 	sqliteDB, _, cleanup := testhelper.SetupTestEnvironment(t)
 	defer cleanup()
 
+	oldSecret := config.Config.App.SessionSecret
+	config.Config.App.SessionSecret = "test-captcha-session-secret"
+	once = sync.Once{}
+	defaultManager = nil
+	t.Cleanup(func() {
+		config.Config.App.SessionSecret = oldSecret
+		once = sync.Once{}
+		defaultManager = nil
+	})
 	r := testhelper.NewTestGinEngine()
 
 	// Mount CAPTCHA API endpoints