docs: clarify subscription bearer responsibility

Author: Ryson-32

README-CN.md

@@ -43,7 +43,7 @@
 
 完整的订阅链接及其中的 token 属于“持有者即可使用”的访问凭证。任何拿到完整链接的人，都可能读取对应的生成配置并使用该订阅。请像保管密码一样保管它，不要把完整链接放进公开仓库、Issue、聊天记录、截图或日志；怀疑泄漏时，应立即删除并重新创建相应订阅，以更换 token。
 
-通过该 token 发起的请求会按订阅所属用户计入访问和风控记录。这是预期的权限模型，因此订阅所有者有责任避免完整链接泄漏。
+通过该 token 发起的所有请求（包括匿名请求和第三方客户端请求）都会按订阅所属用户计入访问和风控记录；反复触发限流可能临时封禁订阅所有者的账号。这是预期的权限模型。请勿公开完整链接或把它交给不受信任的第三方；即使主动在受信任客户端或与受信任的人使用，相关请求和滥用风险仍由订阅所有者承担。
 
 ## 开发说明
 

README.md

@@ -43,7 +43,7 @@
 
 A complete subscription URL and its token are bearer credentials: anyone who obtains the full URL may read the generated configuration and use that subscription. Protect it like a password. Never place the complete URL in public repositories, issues, chat messages, screenshots, or logs. If exposure is suspected, delete and recreate the affected subscription to issue a new token.
 
-Requests made with a token are attributed to the user who owns the subscription for access controls and abuse prevention. This is the intended authorization model, so subscription owners are responsible for keeping complete subscription URLs confidential.
+Every request made with a token, including anonymous requests and requests from third-party clients, is attributed to the subscription owner for access controls and abuse prevention. Repeated rate-limit violations may temporarily ban the owner's account. This is the intended authorization model. Do not publish a complete URL or give it to an untrusted third party; even when using it in a trusted client or with a trusted person, the owner remains responsible for the resulting traffic and abuse risk.
 
 ## Development Notes
 

packages/core/src/subscription/readme-security-contract.test.ts

@@ -0,0 +1,20 @@
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const publicRoot = fileURLToPath(new URL("../../../..", import.meta.url));
+
+describe("public subscription bearer credential guidance", () => {
+  it("warns in both READMEs that token traffic belongs to the owner and may temporarily ban the owner", () => {
+    const chinese = fs.readFileSync(`${publicRoot}/README-CN.md`, "utf8");
+    const english = fs.readFileSync(`${publicRoot}/README.md`, "utf8");
+
+    expect(chinese).toContain("持有者即可使用");
+    expect(chinese).toContain("匿名请求和第三方客户端请求");
+    expect(chinese).toContain("临时封禁订阅所有者");
+
+    expect(english).toContain("bearer credentials");
+    expect(english).toContain("anonymous requests and requests from third-party clients");
+    expect(english).toContain("temporarily ban the owner's account");
+  });
+});

packages/ui/src/product/home/subscription-link-dialog.test.ts

@@ -140,6 +140,9 @@ describe("SubscriptionLinkDialog", () => {
     expect(html).toContain("启用自动更新");
     expect(html).toContain("自动更新间隔");
     expect(html).toContain("注意事项");
+    expect(html).toContain("完整订阅链接是持有者凭证");
+    expect(html).toContain("所有请求均归属您的账号");
+    expect(html).toContain("反复触发限流会临时封禁账号");
     expect(captures.inputs[0]).toMatchObject({ value: "我的配置", maxLength: 100 });
     expect(captures.inputs[1]).toMatchObject({ type: "number", min: 12, step: 1, value: 8 });
     expect(captures.switches).toHaveLength(2);

packages/ui/src/product/home/subscription-link-dialog.tsx

@@ -133,8 +133,8 @@ export function SubscriptionLinkDialog({
               <p className="font-medium mb-1">注意事项</p>
               <ul className="text-xs text-amber-200/70 space-y-1">
                 <li>🔒 配置数据将加密存储于服务器</li>
-                <li>🔑 订阅链接相当于访问凭证，请勿公开分享</li>
-                <li>⏱️ 客户端高频拉取订阅会被封禁，请合理配置</li>
+                <li>🔑 完整订阅链接是持有者凭证，仅在自己控制或信任的客户端中使用</li>
+                <li>⏱️ 所有请求均归属您的账号；反复触发限流会临时封禁账号</li>
                 {isEditingExistingSubscription ? (
                   <>
                     <li>⚠️ 更新将覆盖原订阅配置与订阅源</li>
@@ -204,4 +204,3 @@ export function SubscriptionLinkDialog({
     </Dialog>
   );
 }
-