diff --git a/fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppSearchController.java b/fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppSearchController.java
index ebb9a93..e37ff47 100644
--- a/fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppSearchController.java
+++ b/fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppSearchController.java
@@ -14,7 +14,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
-/** 客户端搜索：按标题或简介模糊匹配已上线短剧。 */
+/** 客户端搜索：按标题或简介模糊匹配已上线短剧。不需要登录。 */
 @Tag(name = "客户端-搜索")
 @RestController
 @RequestMapping("/app")
diff --git a/fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java b/fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java
index e9370e2..1c1f523 100644
--- a/fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java
+++ b/fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java
@@ -40,11 +40,15 @@ public class SecurityConfig {
             "/app/categories/**",
             "/app/banners/**",
             "/app/dramas/**",
+            "/app/search",
             "/app/episodes/*/play",
             "/app/config/**",
             /* 启动配置与公告：客户端登录前就要拿（POST /app/creator/apply 等仍要登录） */
             "/app/config",
             "/app/notices",
+            /* 服务条款与隐私协议：登录前就要能打开，按语言返回 HTML */
+            "/privacy/**",
+            "/terms/**",
             /* 埋点上报：游客浏览也要记录，匿名可访问 */
             "/app/events",
             /* 媒资：封面与视频用 <img>/<video> 直接访问，无法带请求头。