diff --git a/src/core/embedder.py b/src/core/embedder.py
index ff35556..f8271f0 100644
--- a/src/core/embedder.py
+++ b/src/core/embedder.py
@@ -22,8 +22,6 @@ import threading
 import logging
 from typing import Protocol
 
-import requests  # noqa: F401 — DashscopeEmbedder 使用
-
 from src.core.config import EmbedConfig
 
 logger = logging.getLogger("md-vector-db")
diff --git a/src/core/splitters/epub.py b/src/core/splitters/epub.py
index 0c4b247..b7f6f14 100644
--- a/src/core/splitters/epub.py
+++ b/src/core/splitters/epub.py
@@ -40,11 +40,16 @@ class EPUBSplitter:
         extracted_chapters = []
         for item in book.get_items_of_type(ebooklib.ITEM_DOCUMENT):
             try:
-                # ebooklib 的 get_content() 返回 bytes
                 content = item.get_content().decode("utf-8")
             except UnicodeDecodeError:
-                logger.warning("EPUB 跳过一个无法解码的章节: %s", item.get_name())
-                continue
+                try:
+                    content = item.get_content().decode("utf-8-sig")
+                except UnicodeDecodeError:
+                    try:
+                        content = item.get_content().decode("latin-1")
+                    except UnicodeDecodeError:
+                        logger.warning("EPUB 跳过一个无法解码的章节: %s", item.get_name())
+                        continue
 
             # 用 BeautifulSoup 去标签（如果可用），否则保留原样
             try:
diff --git a/src/server/app.py b/src/server/app.py
index 54a0f99..5097c9a 100644
--- a/src/server/app.py
+++ b/src/server/app.py
@@ -79,7 +79,7 @@ async def security_headers_middleware(request: Request, call_next):
     response = await call_next(request)
     response.headers["X-Content-Type-Options"] = "nosniff"
     response.headers["X-Frame-Options"] = "DENY"
-    response.headers["X-XSS-Protection"] = "1; mode=block"
+    response.headers["Content-Security-Policy"] = "default-src 'self'"
     response.headers["Referrer-Policy"] = "no-referrer"
     return response