diff --git a/cloudfunctions/leaderboard/index.js b/cloudfunctions/leaderboard/index.js
index c712edc..7a07f69 100644
--- a/cloudfunctions/leaderboard/index.js
+++ b/cloudfunctions/leaderboard/index.js
@@ -155,7 +155,7 @@ exports.main = async (event) => {
   // Top N for the board
   const ranked = allSorted.slice(0, limit).map((item, i) => ({
     rank: i + 1,
-    openid: item.openid,
+    isMe: item.openid === myOpenid,
     nickname: item.nickname || '',
     name: _displayName(item),
     duration: item.duration,
diff --git a/cloudfunctions/tts/index.js b/cloudfunctions/tts/index.js
index dc70be2..f6f741a 100644
--- a/cloudfunctions/tts/index.js
+++ b/cloudfunctions/tts/index.js
@@ -85,6 +85,8 @@ exports.main = async (event) => {
 
   // 解析 fileID:优先 client 传入,否则查服务端 tts_cache,防 client 传 null 强制重合成(刷 TTS 账单)
   let resolvedFileID = fileID || null
+  // 校验 client 传的 fileID 必须属于 tts-cache 目录,防伪造 cloud:// 换取他人私有文件
+  if (resolvedFileID && !resolvedFileID.includes(CACHE_DIR)) resolvedFileID = null
   if (!resolvedFileID) {
     try {
       const r = await db.collection('tts_cache').doc(cacheKey).get()
diff --git a/pages/leaderboard/leaderboard.wxml b/pages/leaderboard/leaderboard.wxml
index 95d97c8..697e61b 100644
--- a/pages/leaderboard/leaderboard.wxml
+++ b/pages/leaderboard/leaderboard.wxml
@@ -75,7 +75,7 @@
         wx:for="{{rankedList}}"
         wx:key="openid"
         wx:if="{{rankedList.length < 3 || index >= 3}}"
-        class="rank-item {{myEntry && item.openid === myEntry.openid ? 'is-me' : ''}} rank-item--enter"
+        class="rank-item {{item.isMe ? 'is-me' : ''}} rank-item--enter"
         style="animation-delay: {{index < 10 ? index * 60 : 0}}ms;"
       >
         <view class="rank-num {{item.rank === 1 ? 'gold' : item.rank === 2 ? 'silver' : item.rank === 3 ? 'bronze' : ''}}">