diff --git a/fruitshorts-app-api/src/test/java/com/fruitshorts/app/controller/AppCommentCountAnonymousSecurityTest.java b/fruitshorts-app-api/src/test/java/com/fruitshorts/app/controller/AppCommentCountAnonymousSecurityTest.java
new file mode 100644
index 0000000..c34c106
--- /dev/null
+++ b/fruitshorts-app-api/src/test/java/com/fruitshorts/app/controller/AppCommentCountAnonymousSecurityTest.java
@@ -0,0 +1,106 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.app.controller;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fruitshorts.framework.log.AccessDeniedRecorder;
+import com.fruitshorts.framework.security.JwtAuthenticationFilter;
+import com.fruitshorts.framework.security.JwtTokenProvider;
+import com.fruitshorts.framework.security.RestAuthEntryPoint;
+import com.fruitshorts.framework.security.SecurityConfig;
+import com.fruitshorts.interaction.service.CommentService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mockito;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Import;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.web.FilterChainProxy;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit.jupiter.SpringExtension;
+import org.springframework.test.context.web.WebAppConfiguration;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.context.WebApplicationContext;
+import org.springframework.web.servlet.config.annotation.EnableWebMvc;
+
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.mock;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+/** 评论总数接口的安全链契约：匿名只读请求必须直接进入控制器。 */
+@ExtendWith(SpringExtension.class)
+@WebAppConfiguration
+@ContextConfiguration(classes = AppCommentCountAnonymousSecurityTest.TestConfig.class)
+class AppCommentCountAnonymousSecurityTest {
+
+    @Autowired
+    private MockMvc mockMvc;
+
+    @Autowired
+    private CommentService commentService;
+
+    @BeforeEach
+    void setUp() {
+        given(commentService.countByDrama(7L)).willReturn(9L);
+    }
+
+    @Test
+    void should_allow_anonymous_count_request_through_security_chain() throws Exception {
+        mockMvc.perform(get("/app/comments/count").param("dramaId", "7"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.code").value(0))
+                .andExpect(jsonPath("$.data").value(9));
+    }
+
+    @Configuration
+    @EnableWebMvc
+    @EnableWebSecurity
+    @Import(SecurityConfig.class)
+    static class TestConfig {
+
+        @Bean
+        CommentService commentService() {
+            return mock(CommentService.class);
+        }
+
+        @Bean
+        AppCommentController appCommentController(CommentService commentService) {
+            return new AppCommentController(commentService);
+        }
+
+        @Bean
+        JwtAuthenticationFilter jwtAuthenticationFilter() {
+            return new JwtAuthenticationFilter(
+                    mock(JwtTokenProvider.class),
+                    mock(ObjectProvider.class));
+        }
+
+        @Bean
+        RestAuthEntryPoint restAuthEntryPoint(ObjectMapper objectMapper) {
+            return new RestAuthEntryPoint(
+                    objectMapper,
+                    new AccessDeniedRecorder(mock(ObjectProvider.class)));
+        }
+
+        @Bean
+        ObjectMapper objectMapper() {
+            return new ObjectMapper();
+        }
+
+        @Bean
+        MockMvc mockMvc(WebApplicationContext context) {
+            FilterChainProxy securityFilter =
+                    context.getBean("springSecurityFilterChain", FilterChainProxy.class);
+            return MockMvcBuilders.webAppContextSetup(context)
+                    .addFilters(securityFilter)
+                    .build();
+        }
+    }
+}
diff --git a/fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java b/fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java
index 34c7f8f..0496693 100644
--- a/fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java
+++ b/fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java
@@ -74,6 +74,7 @@ public class SecurityConfig {
                         .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                         /* 评论列表允许匿名浏览；发布/删除仍需登录（未列入白名单即需鉴权） */
                         .requestMatchers(HttpMethod.GET, "/app/comments").permitAll()
+                        .requestMatchers(HttpMethod.GET, "/app/comments/count").permitAll()
                         .requestMatchers(PUBLIC_PATHS).permitAll()
                         .anyRequest().authenticated())
                 .exceptionHandling(handling -> handling