diff --git a/.vscode/launch.json b/.vscode/launch.json
index 014e576..edb5398 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -7,7 +7,6 @@
             "hostName": "localhost",
             "port": "5005"
         },
-    java
         {
             "type": "java",
             "name": "CriticalScenarioApplication",
diff --git a/business-css/docs/分析模拟系统方案.md b/business-css/docs/分析模拟系统方案.md
index 9886ead..d947c9c 100644
--- a/business-css/docs/分析模拟系统方案.md
+++ b/business-css/docs/分析模拟系统方案.md
@@ -51,6 +51,23 @@
 4. 增加 OpenAPI 文档与前端集成接口规范。
 5. 引入结果持久化与查询报表。
 
+## 调试与开发指南
+
+### Maven 命令行启动 + 远程调试
+
+如果您偏好使用命令行启动，或者需要模拟特定的 Maven 环境，可采用以下方式：
+
+1. **启动应用**：
+   在终端中运行以下命令，该命令会以调试模式启动应用并监听 `5005` 端口（`suspend=n` 表示不等待调试器连接直接启动，如需等待可改为 `y`）。
+   > 注意：PowerShell 中需要使用单引号包裹 JVM 参数，防止解析错误。
+
+   ```bash
+   mvn -DskipTests spring-boot:run -pl business-css '-Dspring-boot.run.jvmArguments=-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005'
+   ```
+
+2. **附加调试器**：
+   应用启动后，转到 IDE 的 "运行和调试" (Run and Debug) 面板，选择 **"Attach to Remote Program（5005）"** 配置（需确保 `.vscode/launch.json` 中已存在相应配置），然后点击运行。IDE 将连接到正在运行的 Maven 进程，即可开始断点调试。
+
 ## 运维与配置
 - 端口默认 `8082`，环境覆盖通过 `application.yml` 与外部化配置。
 - 数据库连接按环境注入（dev/test/prod）。
diff --git a/business-css/pom.xml b/business-css/pom.xml
index 925ee02..fdadb3a 100644
--- a/business-css/pom.xml
+++ b/business-css/pom.xml
@@ -64,7 +64,14 @@
             <artifactId>platform</artifactId>
             <version>1.0</version>
             <classifier>plain</classifier>
-        </dependency>    
+        </dependency>
+
+        <!-- 显式添加 MyBatis-Plus 依赖，确保测试环境类加载正确 -->
+        <dependency>
+            <groupId>com.baomidou</groupId>
+            <artifactId>mybatis-plus-boot-starter</artifactId>
+            <version>3.5.6</version>
+        </dependency>
 
 
         <!-- Lombok -->
diff --git a/framework/src/main/java/com/yfd/platform/config/SecurityConfig.java b/framework/src/main/java/com/yfd/platform/config/SecurityConfig.java
index a4b2343..4c9710b 100644
--- a/framework/src/main/java/com/yfd/platform/config/SecurityConfig.java
+++ b/framework/src/main/java/com/yfd/platform/config/SecurityConfig.java
@@ -4,6 +4,7 @@ import com.yfd.platform.config.bean.LoginProperties;
 import com.yfd.platform.exception.AccessDeniedHandExcetion;
 import com.yfd.platform.exception.AuthenticationException;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -19,7 +20,10 @@ import org.springframework.security.web.authentication.UsernamePasswordAuthentic
 
 @Configuration
 public class SecurityConfig {
-
+  // 1. 注入配置项，默认为 false
+    @Value("${security.dev.permit:false}")
+    private boolean devPermit;
+    
     @Bean
     public PasswordEncoder passwordEncoder()  {
         return new BCryptPasswordEncoder();
@@ -50,31 +54,36 @@ public class SecurityConfig {
         http
                 .csrf(csrf -> csrf.disable())
                 .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
-                .authorizeHttpRequests(auth -> auth
-                        .requestMatchers("/user/login").anonymous()
-                        .requestMatchers("/user/code").permitAll()
-                        .requestMatchers(HttpMethod.GET,
-                                "/*.html",
-                                "/webSocket/**",
-                                "/assets/**",
-                                "/icon/**").permitAll()
-                        .requestMatchers(
-                                "/swagger-ui.html",
-                                "/swagger-ui/**",
-                                "/v3/api-docs/**",
-                                "/v3/api-docs.yaml",
-                                "/swagger-resources/**",
-                                "/webjars/**",
-                                "/*/api-docs").permitAll()
-                        .requestMatchers(
-                                "/report/**",
-                                "/images/**",
-                                "/pageimage/**",
-                                "/avatar/**",
-                                "/systemurl/**",
-                                "/api/imageserver/upload").permitAll()
-                        .anyRequest().authenticated()
-                )
+                .authorizeHttpRequests(auth -> {
+                    // 如果配置为 true，则允许所有请求
+                    if (devPermit) {
+                        auth.anyRequest().permitAll();
+                    } else {
+                        auth.requestMatchers("/user/login").anonymous()
+                                .requestMatchers("/user/code").permitAll()
+                                .requestMatchers(HttpMethod.GET,
+                                        "/*.html",
+                                        "/webSocket/**",
+                                        "/assets/**",
+                                        "/icon/**").permitAll()
+                                .requestMatchers(
+                                        "/swagger-ui.html",
+                                        "/swagger-ui/**",
+                                        "/v3/api-docs/**",
+                                        "/v3/api-docs.yaml",
+                                        "/swagger-resources/**",
+                                        "/webjars/**",
+                                        "/*/api-docs").permitAll()
+                                .requestMatchers(
+                                        "/report/**",
+                                        "/images/**",
+                                        "/pageimage/**",
+                                        "/avatar/**",
+                                        "/systemurl/**",
+                                        "/api/imageserver/upload").permitAll()
+                                .anyRequest().authenticated();
+                    }
+                })
                 .cors(cors -> {});
 
         http.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);