diff --git a/deploy.sh b/deploy.sh
index 9ebe4f05..b43d68e0 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -25,6 +25,17 @@ echo "[1/5] 拉取最新代码..."
 git pull origin main
 echo "    ✓ 代码已更新"
 
+# 1b. 鉴权面审计闸门（T1, 2026-09-15）：B 类缺口(用户端点无鉴权)存在即中止部署
+echo "[1b/5] 鉴权面审计闸门..."
+cd "$SCRIPT_DIR/backend"
+if ! ./venv/bin/python3 scripts/audit_api_auth_surface.py > /tmp/cma-auth-audit.log 2>&1; then
+  echo "❌ 鉴权面审计发现 B 类缺口（用户端点缺鉴权），中止部署。详见 /tmp/cma-auth-audit.log"
+  tail -20 /tmp/cma-auth-audit.log
+  exit 1
+fi
+cd "$SCRIPT_DIR"
+echo "    ✓ 鉴权面审计通过（无 B 类缺口）"
+
 # 2. 构建前端
 echo "[2/5] 构建前端..."
 cd "$SCRIPT_DIR/frontend"