diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 18ea0ea69..676df4883 100755
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -90,32 +90,60 @@ jobs:
         run: |
           set -eu
           echo "=== Installing gitleaks ==="
-          curl -sSL -o /tmp/gitleaks.tar.gz             "https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz"
-          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
-          chmod +x /tmp/gitleaks
-          /tmp/gitleaks version
+          GITLEAKS_VERSION="v8.18.4"
+          GITLEAKS_ARCH="linux_x64"
+          # 多个下载源，按顺序尝试（国内服务器GitHub常超时）
+          DOWNLOAD_URLS="
+            https://mirror.ghproxy.com/https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_${GITLEAKS_ARCH}.tar.gz
+            https://gh.api.99988866.xyz/https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_${GITLEAKS_ARCH}.tar.gz
+            https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_${GITLEAKS_ARCH}.tar.gz
+          "
+          INSTALLED=false
+          for url in $DOWNLOAD_URLS; do
+            echo "Trying: $url"
+            if curl -fsSL --connect-timeout 15 --max-time 120 -o /tmp/gitleaks.tar.gz "$url"; then
+              echo "Download successful from: $url"
+              tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
+              chmod +x /tmp/gitleaks
+              /tmp/gitleaks version
+              INSTALLED=true
+              break
+            else
+              echo "Download failed from: $url, trying next..."
+            fi
+          done
+          if [ "$INSTALLED" = "false" ]; then
+            echo "ERROR: Failed to download gitleaks from all mirrors"
+            exit 1
+          fi
           echo ""
           echo "=== Running gitleaks scan ==="
           if [ "${{ github.event_name }}" = "pull_request" ]; then
-            # PR触发: 增量扫描（只扫描PR改动）
             echo "PR mode: scanning changed files (origin/${{ github.base_ref }}..HEAD)"
-            /tmp/gitleaks detect               --source .               --config .gitleaks.toml               --verbose               --exit-code 1               --log-opts="origin/${{ github.base_ref }}..HEAD"               || EXIT_CODE=$?
-            if [ "${EXIT_CODE:-0}" = "1" ]; then
-              echo "ERROR: Secrets detected! Check the scan report above."
-              echo "If these are false positives, add them to .gitleaks.toml allowlist."
-              exit 1
-            fi
+            set +e
+            /tmp/gitleaks detect               --source .               --config .gitleaks.toml               --verbose               --exit-code 1               --log-opts="origin/${{ github.base_ref }}..HEAD"
+            GITLEAKS_EXIT=$?
+            set -e
           else
-            # Push到主分支: 全量扫描
             echo "Push mode: full repository scan"
-            /tmp/gitleaks detect               --source .               --config .gitleaks.toml               --verbose               --exit-code 1               || EXIT_CODE=$?
-            if [ "${EXIT_CODE:-0}" = "1" ]; then
-              echo "ERROR: Secrets detected! Check the scan report above."
-              echo "If these are false positives, add them to .gitleaks.toml allowlist."
-              exit 1
-            fi
+            set +e
+            /tmp/gitleaks detect               --source .               --config .gitleaks.toml               --verbose               --exit-code 1
+            GITLEAKS_EXIT=$?
+            set -e
+          fi
+          if [ "$GITLEAKS_EXIT" = "1" ]; then
+            echo ""
+            echo "=========================================="
+            echo "ERROR: Secrets detected!"
+            echo "=========================================="
+            echo "If these are false positives, add them to .gitleaks.toml allowlist."
+            exit 1
+          elif [ "$GITLEAKS_EXIT" != "0" ]; then
+            echo "WARNING: gitleaks exited with code $GITLEAKS_EXIT (non-zero but not detection failure)"
+            echo "This may indicate a configuration issue. Continuing for now..."
+          else
+            echo "gitleaks scan completed - no secrets detected"
           fi
-          echo "gitleaks scan completed - no secrets detected"
       - name: Install dependencies
         shell: sh
         run: |
@@ -139,24 +167,27 @@ jobs:
           pip-audit --version
           echo ""
           echo "=== Scanning Python dependencies ==="
-          # 扫描所有requirements文件
-          /tmp/pip_audit_results=""
-          EXIT_CODE=0
+          set +e
+          HAS_VULN=0
           for req_file in requirements.txt requirements-base.txt requirements-dev.txt requirements-worker.txt; do
             if [ -f "$req_file" ]; then
               echo "--- Scanning $req_file ---"
-              pip-audit -r "$req_file"                 --desc on                 --format json                 --output "/tmp/pip-audit-${req_file%.txt}.json"                 || EXIT_CODE=$?
-              # 生成可读报告
-              pip-audit -r "$req_file"                 --desc on                 --format text                 2>&1 | head -30 || true
+              pip-audit -r "$req_file" --desc on 2>&1 | head -30
+              EXIT_CODE=${PIPESTATUS[0]:-0}
+              if [ "$EXIT_CODE" = "1" ]; then
+                HAS_VULN=1
+              fi
               echo ""
             fi
           done
-          # 当前阶段: 告警模式，不阻断CI（待稳定后改为阻断）
-          echo "pip-audit scan completed (advisory mode - warnings only, not blocking CI)"
-          if [ "$EXIT_CODE" = "1" ]; then
-            echo "WARNING: Vulnerabilities found in dependencies. See details above."
-            echo "This is currently advisory only and does not block CI."
+          set -e
+          echo "=== Summary ==="
+          if [ "$HAS_VULN" = "1" ]; then
+            echo "WARNING: Vulnerabilities found in dependencies."
+          else
+            echo "No known vulnerabilities found in scanned requirements."
           fi
+          echo "Mode: advisory only (not blocking CI)"
           exit 0
       - name: Run code quality checks
         shell: sh