diff --git a/mateclaw-server/src/main/java/vip/mate/tool/browser/BrowserLauncher.java b/mateclaw-server/src/main/java/vip/mate/tool/browser/BrowserLauncher.java
index 6383b622..2286987d 100644
--- a/mateclaw-server/src/main/java/vip/mate/tool/browser/BrowserLauncher.java
+++ b/mateclaw-server/src/main/java/vip/mate/tool/browser/BrowserLauncher.java
@@ -360,7 +360,10 @@ public class BrowserLauncher {
         Browser.NewContextOptions opts = new Browser.NewContextOptions()
                 .setViewportSize(props.getViewportWidth(), props.getViewportHeight())
                 .setLocale("zh-CN");
-        if (props.isIgnoreHttpsErrors()) {
+        // Gate the per-context TLS bypass on allowPrivateNetwork too (matching the
+        // command-line flags above), so ignoring HTTPS errors is scoped to LAN
+        // deployments and never silently disables cert validation for public traffic.
+        if (props.isIgnoreHttpsErrors() && props.isAllowPrivateNetwork()) {
             opts.setIgnoreHTTPSErrors(true);
         }
         BrowserContext context = browser.newContext(opts);
diff --git a/mateclaw-server/src/main/java/vip/mate/tool/browser/UrlSafetyChecker.java b/mateclaw-server/src/main/java/vip/mate/tool/browser/UrlSafetyChecker.java
index 6d783e56..2b3d6dba 100644
--- a/mateclaw-server/src/main/java/vip/mate/tool/browser/UrlSafetyChecker.java
+++ b/mateclaw-server/src/main/java/vip/mate/tool/browser/UrlSafetyChecker.java
@@ -47,7 +47,7 @@ public final class UrlSafetyChecker {
             "instance-data",
             "169.254.169.254",     // AWS / Azure / GCP IMDS
             "100.100.100.200",     // Alibaba Cloud IMDS
-            "192.0.0.192",         // Azure IMDS alternative
+            "192.0.0.192",         // Oracle Cloud IMDS
             "0.0.0.0",
             "::1"
     );