Wodlie · Wodlie · Feb 28, 2026 · Oct 3, 2025 · Oct 5, 2025 · Oct 6, 2025
diff --git a/.github/ISSUE_TEMPLATE/00-bug_report_zh.yml b/.github/ISSUE_TEMPLATE/00-bug_report_zh.yml
@@ -13,7 +13,7 @@ body:
     attributes:
       label: 请确认以下事项
       description: |
-        您必须勾选以下内容，否则您的问题可能会被直接关闭。
+        您必须阅读并检查以下内容，否则您的问题一定会被直接关闭。
         或者您可以去[讨论区](https://github.com/OpenListTeam/OpenList/discussions)。
       options:
         - label: |
@@ -34,6 +34,8 @@ body:
             我认为此问题必须由`OpenList`处理，而非第三方。
         - label: |
             我已确认这个问题在最新版本中没有被修复。
+        - label: |
+            我没有阅读这个清单，只是闭眼选中了所有的复选框，请关闭这个 Issue
 
   - type: input
     id: version
@@ -60,19 +62,21 @@ body:
     validations:
       required: true
   - type: textarea
-    id: config
+    id: logs
     attributes:
-      label: 配置文件内容（必填）
+      label: 日志（必填）
       description: |
-        请提供您的`OpenList`应用的配置文件，并截图相关存储配置。(可隐藏隐私字段)
+        请复制粘贴错误日志，或者截图。(可隐藏隐私字段) [查看方法](https://doc.oplist.org/faq/howto#%E5%A6%82%E4%BD%95%E5%BF%AB%E9%80%9F%E5%AE%9A%E4%BD%8Dbug)
     validations:
       required: true
   - type: textarea
-    id: logs
+    id: config
     attributes:
-      label: 日志（可选）
+      label: 配置文件内容（必填）
       description: |
-        请复制粘贴错误日志，或者截图。(可隐藏隐私字段) [查看方法](https://doc.oplist.org/faq/howto#%E5%A6%82%E4%BD%95%E5%BF%AB%E9%80%9F%E5%AE%9A%E4%BD%8Dbug)
+        请提供您的`OpenList`应用的配置文件，并截图相关存储配置。(可隐藏隐私字段)
+    validations:
+      required: true
   - type: textarea
     id: reproduction
     attributes:

diff --git a/.github/ISSUE_TEMPLATE/01-bug_report_en.yml b/.github/ISSUE_TEMPLATE/01-bug_report_en.yml
@@ -13,7 +13,7 @@ body:
     attributes:
       label: Please confirm the following
       description: |
-        You must check all the following, otherwise your issue may be closed directly.
+        You must read and check all the following, otherwise your issue will definitely be closed directly.
         Or you can go to the [discussions](https://github.com/OpenListTeam/OpenList/discussions).
       options:
         - label: |
@@ -34,6 +34,8 @@ body:
             I believe this issue must be handled by `OpenList` and not by a third party.
         - label: |
             I confirm this issue is not fixed in the latest version.
+        - label: |
+            I have not read these checkboxes and therefore I just ticked them all, Please close this issue
 
   - type: input
     id: version
@@ -60,19 +62,21 @@ body:
     validations:
       required: true
   - type: textarea
-    id: config
+    id: logs
     attributes:
-      label: Configuration File Content (required)
+      label: Logs (required)
       description: |
-        Please provide your `OpenList` application's configuration file and a screenshot of the relevant storage configuration. (You may mask sensitive fields)
+        Please copy and paste any relevant log output or screenshots. (You may mask sensitive fields) [Guide](https://doc.oplist.org/faq/howto#how-to-quickly-locate-bugs)
     validations:
       required: true
   - type: textarea
-    id: logs
+    id: config
     attributes:
-      label: Logs (optional)
+      label: Configuration File Content (required)
       description: |
-        Please copy and paste any relevant log output or screenshots. (You may mask sensitive fields) [Guide](https://doc.oplist.org/faq/howto#how-to-quickly-locate-bugs)
+        Please provide your `OpenList` application's configuration file and a screenshot of the relevant storage configuration. (You may mask sensitive fields)
+    validations:
+      required: true
   - type: textarea
     id: reproduction
     attributes:

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -2,11 +2,13 @@
   Provide a general summary of your changes in the Title above.
   The PR title must start with `feat(): `, `docs(): `, `fix(): `, `style(): `, or `refactor(): `, `chore(): `. For example: `feat(component): add new feature`.
   If it spans multiple components, use the main component as the prefix and enumerate in the title, describe in the body.
+  For breaking changes, add `!` after the type, e.g., `feat(component)!: breaking change`.
 -->
 <!--
   在上方标题中提供您更改的总体摘要。
   PR 标题需以 `feat(): `, `docs(): `, `fix(): `, `style(): `, `refactor(): `, `chore(): ` 其中之一开头，例如：`feat(component): 新增功能`。
   如果跨多个组件，请使用主要组件作为前缀，并在标题中枚举、描述中说明。
+  如果是破坏性变更，请在类型后添加 `!`，例如 `feat(component)!: 破坏性变更`。
 -->
 
 ## Description / 描述

diff --git a/.github/workflows/issue_pr_comment.yml b/.github/workflows/issue_pr_comment.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           script: |
             const issueBody = context.payload.issue.body || "";
-            const unchecked = /- \[ \] /.test(issueBody);
+            const unchecked = /- \[ \] (?!我没有阅读这个清单|I have not read these checkboxes)/.test(issueBody);
             let comment = "感谢您联系OpenList。我们会尽快回复您。\n";
             comment += "Thanks for contacting OpenList. We will reply to you as soon as possible.\n\n";
             if (unchecked) {
@@ -47,12 +47,14 @@ jobs:
         with:
           script: |
             const title = context.payload.pull_request.title || "";
-            const ok = /^(feat|docs|fix|style|refactor|chore)\(.+?\): /i.test(title);
+            const ok = /^(feat|docs|fix|style|refactor|chore)\(.+?\)!?: /i.test(title);
             if (!ok) {
               let comment = "⚠️ PR 标题需以 `feat(): `, `docs(): `, `fix(): `, `style(): `, `refactor(): `, `chore(): ` 其中之一开头，例如：`feat(component): 新增功能`。\n";
               comment += "⚠️ The PR title must start with `feat(): `, `docs(): `, `fix(): `, `style(): `, or `refactor(): `, `chore(): `. For example: `feat(component): add new feature`.\n\n";
               comment += "如果跨多个组件，请使用主要组件作为前缀，并在标题中枚举、描述中说明。\n";
               comment += "If it spans multiple components, use the main component as the prefix and enumerate in the title, describe in the body.\n\n";
+              comment += "如果是破坏性变更，请在类型后添加 `!`，例如 `feat(component)!: 破坏性变更`。\n";
+              comment += "For breaking changes, add `!` after the type, e.g., `feat(component)!: breaking change`.\n\n";
               await github.rest.issues.createComment({
                 ...context.repo,
                 issue_number: context.issue.number,

diff --git a/.gitignore b/.gitignore
@@ -31,4 +31,5 @@ output/
 /public/dist/*
 /!public/dist/README.md
 
-.VSCodeCounter
+.VSCodeCounter/OpenList
+/OpenList
diff --git a/README.md b/README.md
@@ -64,8 +64,9 @@ Thank you for your support and understanding of the OpenList project.
   - [x] [UPYUN Storage Service](https://www.upyun.com/products/file-storage)
   - [x] [WebDAV](https://en.wikipedia.org/wiki/WebDAV)
   - [x] Teambition([China](https://www.teambition.com), [International](https://us.teambition.com))
-  - [x] [Mediatrack](https://www.mediatrack.cn)
   - [x] [MediaFire](https://www.mediafire.com)
+  - [x] [Mediatrack](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
   - [x] [139yun](https://yun.139.com) (Personal, Family, Group)
   - [x] [YandexDisk](https://disk.yandex.com)
   - [x] [BaiduNetdisk](http://pan.baidu.com)
@@ -121,12 +122,17 @@ Thank you for your support and understanding of the OpenList project.
 
 ## Demo
 
-N/A (to be rebuilt)
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)
 
 ## Discussion
 
 Please refer to [*Discussions*](https://github.com/OpenListTeam/OpenList/discussions) for raising general questions, ***Issues* is for bug reports and feature requests only.**
 
+## Sponsor
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
 ## License
 
 The `OpenList` is open-source software licensed under the [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) license.

diff --git a/README_cn.md b/README_cn.md
@@ -64,8 +64,9 @@ OpenList 是一个由 OpenList 团队独立维护的开源项目，遵循 AGPL-3
   - [x] [又拍云对象存储](https://www.upyun.com/products/file-storage)
   - [x] [WebDAV](https://en.wikipedia.org/wiki/WebDAV)
   - [x] Teambition([中国](https://www.teambition.com), [国际](https://us.teambition.com))
-  - [x] [分秒帧](https://www.mediatrack.cn)
   - [x] [MediaFire](https://www.mediafire.com)
+  - [x] [分秒帧](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
   - [x] [和彩云](https://yun.139.com)（个人、家庭、群组）
   - [x] [YandexDisk](https://disk.yandex.com)
   - [x] [百度网盘](http://pan.baidu.com)
@@ -121,12 +122,17 @@ OpenList 是一个由 OpenList 团队独立维护的开源项目，遵循 AGPL-3
 
 ## 演示
 
-N/A（待重建）
+- 🇨🇳 [国内演示站](https://demo.oplist.org.cn)
+- 🌎 [海外演示站](https://demo.oplist.org)
 
 ## 讨论
 
 如有一般性问题请前往 [*Discussions*](https://github.com/OpenListTeam/OpenList/discussions) 讨论区，***Issues* 仅用于错误报告和功能请求。**
 
+## 赞助者
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
 ## 许可证
 
 `OpenList` 是基于 [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) 许可证的开源软件。

diff --git a/README_ja.md b/README_ja.md
@@ -65,6 +65,7 @@ OpenListプロジェクトへのご支援とご理解をありがとうござい
   - [x] [WebDAV](https://en.wikipedia.org/wiki/WebDAV)
   - [x] Teambition([中国](https://www.teambition.com), [国際](https://us.teambition.com))
   - [x] [Mediatrack](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
   - [x] [139yun](https://yun.139.com)（個人、家族、グループ）
   - [x] [YandexDisk](https://disk.yandex.com)
   - [x] [BaiduNetdisk](http://pan.baidu.com)
@@ -121,12 +122,17 @@ OpenListプロジェクトへのご支援とご理解をありがとうござい
 
 ## デモ
 
-N/A（再構築中）
+- 🌎 [グローバルデモ](https://demo.oplist.org)
+- 🇨🇳 [CNデモ](https://demo.oplist.org.cn)
 
 ## ディスカッション
 
 一般的な質問は [*Discussions*](https://github.com/OpenListTeam/OpenList/discussions) をご利用ください。***Issues* はバグ報告と機能リクエスト専用です。**
 
+## スポンサー
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
 ## ライセンス
 
 「OpenList」は [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) ライセンスの下で公開されているオープンソースソフトウェアです。

diff --git a/README_nl.md b/README_nl.md
@@ -66,6 +66,7 @@ Dank u voor uw ondersteuning en begrip
   - [x] Teambition([China](https://www.teambition.com), [Internationaal](https://us.teambition.com))
   - [x] [MediaFire](https://www.mediafire.com)
   - [x] [Mediatrack](https://www.mediatrack.cn)
+  - [x] [ProtonDrive](https://proton.me/drive)
   - [x] [139yun](https://yun.139.com) (Persoonlijk, Familie, Groep)
   - [x] [YandexDisk](https://disk.yandex.com)
   - [x] [BaiduNetdisk](http://pan.baidu.com)
@@ -121,12 +122,17 @@ Dank u voor uw ondersteuning en begrip
 
 ## Demo
 
-N.v.t. (wordt opnieuw opgebouwd)
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)
 
 ## Discussie
 
 Stel algemene vragen in [*Discussions*](https://github.com/OpenListTeam/OpenList/discussions), ***Issues* zijn alleen voor bugmeldingen en feature requests.**
 
+## Sponsoren
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
 ## Licentie
 
 `OpenList` is open-source software onder de [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) licentie.

diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,89 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest stable release receives security patches. We strongly recommend always keeping OpenList up to date.
+
+| Version              | Supported          |
+| -------------------- | ------------------ |
+| Latest stable (v4.x) | :white_check_mark: |
+| Older versions       | :x:                |
+
+## Reporting a Vulnerability
+
+**Please do NOT report security vulnerabilities through public GitHub Issues.**
+
+If you discover a security vulnerability in OpenList, please report it responsibly by using one of the following channels:
+
+- **GitHub Private Security Advisory** (preferred): [Submit here](https://github.com/OpenListTeam/OpenList/security/advisories/new)
+- **Telegram**: Contact a maintainer privately via [@OpenListTeam](https://t.me/OpenListTeam)
+
+When reporting, please include as much of the following as possible:
+
+- A description of the vulnerability and its potential impact
+- The affected version(s)
+- Step-by-step instructions to reproduce the issue
+- Any proof-of-concept code or screenshots (if applicable)
+- Suggested mitigation or fix (optional but appreciated)
+
+## Security Best Practices for Users
+
+To keep your OpenList instance secure:
+
+- Always update to the latest release.
+- Use a strong, unique admin password and change it after first login.
+- Enable HTTPS (TLS) for your deployment — do **not** expose OpenList over plain HTTP on the public internet.
+- Limit exposed ports using a reverse proxy (e.g., Nginx, Caddy).
+- Set up access controls and avoid enabling guest access unless necessary.
+- Regularly review mounted storage permissions and revoke unused API tokens.
+- When using Docker, avoid running the container as root if possible.
+
+## Acknowledgments
+
+We sincerely thank all security researchers and community members who responsibly disclose vulnerabilities and help make OpenList safer for everyone.
+
+---
+
+# 安全政策
+
+## 支持的版本
+
+我们仅对最新稳定版本提供安全补丁。强烈建议始终保持 OpenList 为最新版本。
+
+| 版本               | 是否支持           |
+| ------------------ | ------------------ |
+| 最新稳定版（v4.x） | :white_check_mark: |
+| 旧版本             | :x:                |
+
+## 报告漏洞
+
+**请勿通过公开的 GitHub Issues 报告安全漏洞。**
+
+如果您在 OpenList 中发现安全漏洞，请通过以下渠道之一负责任地进行报告：
+
+- **GitHub 私密安全公告**（推荐）：[点击提交](https://github.com/OpenListTeam/OpenList/security/advisories/new)
+- **Telegram**：通过 [@OpenListTeam](https://t.me/OpenListTeam) 私信联系维护者
+
+报告时，请尽量提供以下信息：
+
+- 漏洞描述及其潜在影响
+- 受影响的版本
+- 复现问题的详细步骤
+- 概念验证代码或截图（如有）
+- 建议的缓解措施或修复方案（可选，但非常欢迎）
+
+## 用户安全最佳实践
+
+为保障您的 OpenList 实例安全：
+
+- 始终更新至最新版本。
+- 使用强且唯一的管理员密码，并在首次登录后立即修改。
+- 为您的部署启用 HTTPS（TLS）—— **请勿**在公网上以明文 HTTP 方式暴露 OpenList。
+- 使用反向代理（如 Nginx、Caddy）限制对外暴露的端口。
+- 配置访问控制，非必要情况下不要开启访客访问。
+- 定期检查已挂载存储的权限，并撤销未使用的 API 令牌。
+- 使用 Docker 部署时，尽可能避免以 root 用户运行容器。
+
+## 致谢
+
+我们衷心感谢所有负责任地披露漏洞、帮助 OpenList 变得更加安全的安全研究人员和社区成员。
diff --git a/cmd/admin.go b/cmd/admin.go
@@ -6,6 +6,7 @@ package cmd
 import (
 	"fmt"
 
+	"github.com/OpenListTeam/OpenList/v4/internal/bootstrap"
 	"github.com/OpenListTeam/OpenList/v4/internal/conf"
 	"github.com/OpenListTeam/OpenList/v4/internal/op"
 	"github.com/OpenListTeam/OpenList/v4/internal/setting"
@@ -20,8 +21,8 @@ var AdminCmd = &cobra.Command{
 	Aliases: []string{"password"},
 	Short:   "Show admin user's info and some operations about admin user's password",
 	Run: func(cmd *cobra.Command, args []string) {
-		Init()
-		defer Release()
+		bootstrap.Init()
+		defer bootstrap.Release()
 		admin, err := op.GetAdmin()
 		if err != nil {
 			utils.Log.Errorf("failed get admin user: %+v", err)
@@ -61,17 +62,17 @@ var ShowTokenCmd = &cobra.Command{
 	Use:   "token",
 	Short: "Show admin token",
 	Run: func(cmd *cobra.Command, args []string) {
-		Init()
-		defer Release()
+		bootstrap.Init()
+		defer bootstrap.Release()
 		token := setting.GetStr(conf.Token)
 		utils.Log.Infof("show admin token from CLI")
 		fmt.Println("Admin token:", token)
 	},
 }
 
 func setAdminPassword(pwd string) {
-	Init()
-	defer Release()
+	bootstrap.Init()
+	defer bootstrap.Release()
 	admin, err := op.GetAdmin()
 	if err != nil {
 		utils.Log.Errorf("failed get admin user: %+v", err)