Merge pull request #2961 from CheriWen/fix/cwe-204-info-disclosure-key-oracle

[Security] fix: return 404 instead of 403 to prevent key ID enumeration

backend/internal/handler/api_key_handler.go

@@ -131,7 +131,7 @@ func (h *APIKeyHandler) GetByID(c *gin.Context) {
 
 	// 验证所有权
 	if key.UserID != subject.UserID {
-		response.Forbidden(c, "Not authorized to access this key")
+		response.NotFound(c, "API key not found")
 		return
 	}