diff --git a/docs/images/architecture.png b/docs/images/architecture.png
index 1e0a7416a..3522ea5cc 100644
Binary files a/docs/images/architecture.png and b/docs/images/architecture.png differ
diff --git a/internal/handler/initialization.go b/internal/handler/initialization.go
index 27c7fbb11..95ebfd3b6 100644
--- a/internal/handler/initialization.go
+++ b/internal/handler/initialization.go
@@ -198,7 +198,7 @@ type InitializationRequest struct {
 // UpdateKBConfig 根据知识库ID和模型ID更新配置（简化版）
 func (h *InitializationHandler) UpdateKBConfig(c *gin.Context) {
 	ctx := c.Request.Context()
-	kbIdStr := c.Param("kbId")
+	kbIdStr := secutils.SanitizeForLog(c.Param("kbId"))
 
 	var req KBModelConfigRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -350,7 +350,7 @@ func (h *InitializationHandler) UpdateKBConfig(c *gin.Context) {
 // InitializeByKB 根据知识库ID执行配置更新
 func (h *InitializationHandler) InitializeByKB(c *gin.Context) {
 	ctx := c.Request.Context()
-	kbIdStr := c.Param("kbId")
+	kbIdStr := secutils.SanitizeForLog(c.Param("kbId"))
 
 	var req InitializationRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -1057,7 +1057,7 @@ func (h *InitializationHandler) updateTaskStatus(
 // GetCurrentConfigByKB 根据知识库ID获取配置信息
 func (h *InitializationHandler) GetCurrentConfigByKB(c *gin.Context) {
 	ctx := c.Request.Context()
-	kbIdStr := c.Param("kbId")
+	kbIdStr := secutils.SanitizeForLog(c.Param("kbId"))
 
 	logger.Info(ctx, "Getting configuration for knowledge base")
 
diff --git a/internal/handler/message.go b/internal/handler/message.go
index 76122fdab..78544757d 100644
--- a/internal/handler/message.go
+++ b/internal/handler/message.go
@@ -39,7 +39,7 @@ func (h *MessageHandler) LoadMessages(c *gin.Context) {
 	logger.Info(ctx, "Start loading messages")
 
 	// Get path parameters and query parameters
-	sessionID := c.Param("session_id")
+	sessionID := secutils.SanitizeForLog(c.Param("session_id"))
 	limit := secutils.SanitizeForLog(c.DefaultQuery("limit", "20"))
 	beforeTimeStr := secutils.SanitizeForLog(c.DefaultQuery("before_time", ""))
 
diff --git a/internal/handler/model.go b/internal/handler/model.go
index 1bbf0899c..2666bb50c 100644
--- a/internal/handler/model.go
+++ b/internal/handler/model.go
@@ -97,7 +97,7 @@ func (h *ModelHandler) CreateModel(c *gin.Context) {
 	model := &types.Model{
 		TenantID:    tenantID,
 		Name:        secutils.SanitizeForLog(req.Name),
-		Type:        req.Type,
+		Type:        types.ModelType(secutils.SanitizeForLog(string(req.Type))),
 		Source:      req.Source,
 		Description: secutils.SanitizeForLog(req.Description),
 		Parameters:  req.Parameters,
diff --git a/internal/handler/tag.go b/internal/handler/tag.go
index 49f89c7fb..7b2209b80 100644
--- a/internal/handler/tag.go
+++ b/internal/handler/tag.go
@@ -8,6 +8,7 @@ import (
 	"github.com/Tencent/WeKnora/internal/errors"
 	"github.com/Tencent/WeKnora/internal/logger"
 	"github.com/Tencent/WeKnora/internal/types/interfaces"
+	secutils "github.com/Tencent/WeKnora/internal/utils"
 )
 
 // TagHandler handles knowledge base tag operations.
@@ -23,7 +24,7 @@ func NewTagHandler(tagService interfaces.KnowledgeTagService) *TagHandler {
 // ListTags returns all tags under a knowledge base with statistics.
 func (h *TagHandler) ListTags(c *gin.Context) {
 	ctx := c.Request.Context()
-	kbID := c.Param("id")
+	kbID := secutils.SanitizeForLog(c.Param("id"))
 
 	tags, err := h.tagService.ListTags(ctx, kbID)
 	if err != nil {
@@ -47,7 +48,7 @@ type createTagRequest struct {
 // CreateTag creates a new tag.
 func (h *TagHandler) CreateTag(c *gin.Context) {
 	ctx := c.Request.Context()
-	kbID := c.Param("id")
+	kbID := secutils.SanitizeForLog(c.Param("id"))
 
 	var req createTagRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -56,7 +57,8 @@ func (h *TagHandler) CreateTag(c *gin.Context) {
 		return
 	}
 
-	tag, err := h.tagService.CreateTag(ctx, kbID, req.Name, req.Color, req.SortOrder)
+	tag, err := h.tagService.CreateTag(ctx, kbID,
+		secutils.SanitizeForLog(req.Name), secutils.SanitizeForLog(req.Color), req.SortOrder)
 	if err != nil {
 		logger.ErrorWithFields(ctx, err, map[string]interface{}{
 			"kb_id": kbID,
@@ -81,7 +83,7 @@ type updateTagRequest struct {
 func (h *TagHandler) UpdateTag(c *gin.Context) {
 	ctx := c.Request.Context()
 
-	tagID := c.Param("tag_id")
+	tagID := secutils.SanitizeForLog(c.Param("tag_id"))
 	var req updateTagRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		logger.Error(ctx, "Failed to bind update tag payload", err)
@@ -107,7 +109,7 @@ func (h *TagHandler) UpdateTag(c *gin.Context) {
 // DeleteTag deletes a tag. Use query param force=true to force delete even if referenced.
 func (h *TagHandler) DeleteTag(c *gin.Context) {
 	ctx := c.Request.Context()
-	tagID := c.Param("tag_id")
+	tagID := secutils.SanitizeForLog(c.Param("tag_id"))
 
 	force := c.Query("force") == "true"