diff --git a/scripts/load_path.py b/scripts/load_path.py
index 9da528f..f0ce8cf 100644
--- a/scripts/load_path.py
+++ b/scripts/load_path.py
@@ -51,16 +51,17 @@ PERMS = [
     # showcase
     ("/showcase", "showcase", "logined"),
     ("/showcase/*", "showcase", "logined"),
-    # app root (any)
-    ("/**", "app", "any"),
+    # app root (any)：仅登录页资产/全局静态资源。
+    # 注意：禁止 /** any——会让匿名访问全部路径（含五条产线）。
+    # 产线 shell（sdlc/core/ops/dist index.ui）须 logined，产线对匿名不可见。
     ("/index.ui", "app", "any"),
     ("/todo_badge.js", "app", "any"),
     ("/index_tab.js", "app", "any"),
     ("/theme_toggle.js", "app", "any"),
-    ("/pipeline-sdlc/index.ui", "pipeline_sdlc", "any"),
-    ("/pipeline_core/index.ui", "pipeline_core", "any"),
-    ("/pipeline_ops/index.ui", "pipeline_ops", "any"),
-    ("/pipeline_dist/index.ui", "pipeline_dist", "any"),
+    ("/pipeline-sdlc/index.ui", "pipeline_sdlc", "logined"),
+    ("/pipeline_core/index.ui", "pipeline_core", "logined"),
+    ("/pipeline_ops/index.ui", "pipeline_ops", "logined"),
+    ("/pipeline_dist/index.ui", "pipeline_dist", "logined"),
 ]