diff --git a/changelogs/2026-03/2026-03-23_1918_a8ff0a3_security.md b/changelogs/2026-03/2026-03-23_1918_a8ff0a3_security.md
new file mode 100644
index 0000000..164428f
--- /dev/null
+++ b/changelogs/2026-03/2026-03-23_1918_a8ff0a3_security.md
@@ -0,0 +1,50 @@
+# 接口变更记录 — 2026-03-23 19:18
+
+> **提交** `a8ff0a3` · **作者** wx · **时间** 2026-03-23 19:18:30 +0800
+>
+> security: 新增代码安全审计修复（10项）
+
+## 变更总览
+
+- **小程序聚合服务**
+  - MpInsurance (+1)
+
+---
+
+## 小程序聚合服务
+
+### MpInsurance
+
+> 📖 **接口文档**: [http://192.168.100.236:8086/doc.html](http://192.168.100.236:8086/doc.html) → 标签 **「C端 - 保险接口」**
+
+### 🆕 `GET` /mp/insurance/policy/{insuranceOrderId}/download — 下载单张保单PDF
+
+> 根据保险订单ID下载单张保单PDF，返回Base64编码。
+
+**参数**
+
+  - `{insuranceOrderId}` (`Long`) — 路径参数：保险订单ID
+
+**响应** `Result<String>`
+
+---
+
+<details>
+<summary>📁 全部变更文件 (点击展开)</summary>
+
+```
+M	hl-mp-service/src/main/java/com/hulalv/mp/controller/MpInsuranceController.java
+M	hl-mp-service/src/main/java/com/hulalv/mp/dto/MpRefundAppealRequest.java
+M	hl-mp-service/src/main/java/com/hulalv/mp/feign/MpInsuranceFeignClient.java
+M	hl-mp-service/src/main/java/com/hulalv/mp/feign/MpInsuranceFeignFallbackFactory.java
+M	hl-order-service/src/main/java/com/hulalv/order/controller/AdminOrderController.java
+M	hl-order-service/src/main/java/com/hulalv/order/controller/InternalMpOrderController.java
+M	hl-order-service/src/main/java/com/hulalv/order/dto/HotelAssignmentRequest.java
+M	hl-order-service/src/main/java/com/hulalv/order/dto/RefundAppealRequest.java
+M	hl-order-service/src/main/java/com/hulalv/order/dto/VehicleAssignmentRequest.java
+M	hl-order-service/src/main/java/com/hulalv/order/job/DepartureReminderJob.java
+M	hl-order-service/src/main/java/com/hulalv/order/service/OrderAutoProcessingService.java
+M	hl-order-service/src/main/java/com/hulalv/order/service/OrderService.java
+M	hl-order-service/src/main/java/com/hulalv/order/service/RefundApplicationService.java
+```
+</details>
\ No newline at end of file