diff --git a/dnfs/dnfs.py b/dnfs/dnfs.py
index 8a559c8..d317e2c 100755
--- a/dnfs/dnfs.py
+++ b/dnfs/dnfs.py
@@ -38,7 +38,7 @@ _DBV2_ADDR = '127.0.0.1'
 _DBV2_PORT = 8005
 
 # 管理员账号：删除/更新节点时豁免所有权校验（保留旧的 'admin' 以兼容历史数据）
-ADMIN_USERS = ('admin', 'admin@qsont.me')
+ADMIN_USERS = ('admin@qsont.me', 'qing@qsont.me')
 
 def _call_dbv2(payload: dict, timeout: int = 10) -> dict:
     """通过 pymsg 短连接调用 dbv2 数据库服务。
diff --git a/gateway/_run.sh b/gateway/_run.sh
index df8a225..172a051 100644
--- a/gateway/_run.sh
+++ b/gateway/_run.sh
@@ -1,3 +1,4 @@
 #!/bin/bash
 cd "$(dirname "$0")" || exit
+sleep 1
 exec ./build/gateway.out -i example.ini #1>/dev/null
diff --git a/waf/rules/local/custom.conf b/waf/rules/local/custom.conf
index 4f57cd9..9c858de 100644
--- a/waf/rules/local/custom.conf
+++ b/waf/rules/local/custom.conf
@@ -2,25 +2,25 @@
 # ID 段：100000-199999
 
 # 100001: 拦截 SQL 注入特征（UNION SELECT）
-SecRule REQUEST_URI|ARGS "@rx (?i)union[\s/*]+select" \
-    "id:100001,phase:1,deny,status:403,log,msg:'SQL injection: UNION SELECT'"
+#SecRule REQUEST_URI|ARGS "@rx (?i)union[\s/*]+select" \
+#    "id:100001,phase:1,deny,status:403,log,msg:'SQL injection: UNION SELECT'"
 
-# 100002: 拦截 SQL 注释符
-SecRule ARGS "@rx (?i)(--|#|/\*.*\*/)" \
-    "id:100002,phase:2,deny,status:403,log,msg:'SQL injection: comment'"
+## 100002: 拦截 SQL 注释符
+#SecRule ARGS "@rx (?i)(--|#|/\*.*\*/)" \
+#    "id:100002,phase:2,deny,status:403,log,msg:'SQL injection: comment'"
 
 # 100003: 拦截 XSS 标签
-SecRule ARGS|REQUEST_HEADERS "@rx (?i)<script|javascript:|onerror=|onload=" \
-    "id:100003,phase:2,deny,status:403,log,msg:'XSS probe'"
+#SecRule ARGS|REQUEST_HEADERS "@rx (?i)<script|javascript:|onerror=|onload=" \
+#    "id:100003,phase:2,deny,status:403,log,msg:'XSS probe'"
 
 # 100004: 路径遍历
-SecRule REQUEST_URI|ARGS "@rx (?i)\.\./|\.\.%2f|\.\.%5c" \
-    "id:100004,phase:1,deny,status:403,log,msg:'Path traversal'"
+#SecRule REQUEST_URI|ARGS "@rx (?i)\.\./|\.\.%2f|\.\.%5c" \
+#    "id:100004,phase:1,deny,status:403,log,msg:'Path traversal'"
 
 # 100005: 命令注入常见关键字
-SecRule ARGS "@rx (?i)(;|\|)&?\s*(cat|ls|id|whoami|uname|wget|curl|bash|sh)\s" \
-    "id:100005,phase:2,deny,status:403,log,msg:'Command injection'"
+#SecRule ARGS "@rx (?i)(;|\|)&?\s*(cat|ls|id|whoami|uname|wget|curl|bash|sh)\s" \
+#    "id:100005,phase:2,deny,status:403,log,msg:'Command injection'"
 
 # 100006: 已知恶意扫描器 UA
-SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(nikto|sqlmap|nmap|masscan|acunetix|nessus)" \
-    "id:100006,phase:1,deny,status:403,log,msg:'Malicious scanner UA'"
+#SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(nikto|sqlmap|nmap|masscan|acunetix|nessus)" \
+#    "id:100006,phase:1,deny,status:403,log,msg:'Malicious scanner UA'"