diff --git a/.gitea/scripts/deploy-nexus.sh b/.gitea/scripts/deploy-nexus.sh
index 12a8e62..025fd71 100755
--- a/.gitea/scripts/deploy-nexus.sh
+++ b/.gitea/scripts/deploy-nexus.sh
@@ -2,15 +2,19 @@
 set -eu
 
 DEPLOY_PATH="${DEPLOY_PATH:-/home/projekte_bao/openclaw/data/openclaw/workspace/nexus}"
-ENV_TMPFILE="${ENV_TMPFILE:-/tmp/nexus-deploy-env}"
-COMPOSE_SCRIPT="${COMPOSE_SCRIPT:-/tmp/nexus-compose-deploy.sh}"
+ENV_TMPFILE_TEMPLATE="${ENV_TMPFILE:-/tmp/nexus-deploy-env}"
+COMPOSE_SCRIPT_TEMPLATE="${COMPOSE_SCRIPT:-/tmp/nexus-compose-deploy.sh}"
+ENV_TMPFILE=""
+COMPOSE_SCRIPT=""
 BASE_URL="${BASE_URL:-https://nexus.noveria.net}"
 
 cleanup() {
-  if [ -f "$ENV_TMPFILE" ]; then
+  if [ -n "$ENV_TMPFILE" ] && [ -f "$ENV_TMPFILE" ]; then
     shred -u "$ENV_TMPFILE" 2>/dev/null || rm -f "$ENV_TMPFILE"
   fi
-  rm -f "$COMPOSE_SCRIPT"
+  if [ -n "$COMPOSE_SCRIPT" ]; then
+    rm -f "$COMPOSE_SCRIPT"
+  fi
 }
 trap cleanup EXIT INT TERM
 
@@ -26,6 +30,18 @@ require_env() {
 require_env ENV_POSTGRES_PASSWORD
 require_env ENV_JWT_KEY
 
+secure_tmpfile() {
+  template="$1"
+  dir="$(dirname "$template")"
+  base="$(basename "$template")"
+  mkdir -p "$dir"
+  mktemp "$dir/$base.XXXXXX"
+}
+
+ENV_TMPFILE="$(secure_tmpfile "$ENV_TMPFILE_TEMPLATE")"
+COMPOSE_SCRIPT="$(secure_tmpfile "$COMPOSE_SCRIPT_TEMPLATE")"
+chmod 600 "$ENV_TMPFILE" "$COMPOSE_SCRIPT"
+
 if [ ! -f VERSION ]; then
   echo "VERSION file not found" >&2
   exit 1
@@ -61,9 +77,33 @@ docker run --rm \
   alpine:3.20 \
   sh -c '
     set -eu
-    cd /src
-    find . -mindepth 1 -maxdepth 1 ! -name .git -exec cp -r {} /dest/ \;
     dest_owner="$(stat -c "%u:%g" /dest)"
+
+    is_protected_path() {
+      case "$1" in
+        ./.git|./.git/*|./.env|./.env.*|./data|./data/*|./logs|./logs/*|./backups|./backups/*|./tmp|./tmp/*|./uploads|./uploads/*|./storage|./storage/*)
+          return 0
+          ;;
+        *)
+          return 1
+          ;;
+      esac
+    }
+
+    cd /dest
+    find . -mindepth 1 -maxdepth 1 | while IFS= read -r path; do
+      if ! is_protected_path "$path"; then
+        rm -rf "$path"
+      fi
+    done
+
+    cd /src
+    find . -mindepth 1 -maxdepth 1 | while IFS= read -r path; do
+      if ! is_protected_path "$path"; then
+        cp -a "$path" /dest/
+      fi
+    done
+
     chown -R "$dest_owner" /dest
   '
 
@@ -117,9 +157,23 @@ check() {
   fi
 }
 
+check_post() {
+  path="$1"
+  expected="$2"
+  label="$3"
+  code="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 -X POST -H 'Content-Type: application/json' --data '{}' "$BASE_URL$path")"
+  printf '%-28s HTTP %s\n' "$label" "$code"
+  if [ "$code" = "$expected" ]; then
+    pass=$((pass + 1))
+  else
+    fail=$((fail + 1))
+  fi
+}
+
 check "/dashboard" "200" "Dashboard"
 check "/health" "200" "Health"
 check "/api/v1/operations/snapshot" "401" "Operations auth"
+check_post "/api/v1/chat" "401" "Chat auth"
 
 if [ "$fail" -ne 0 ]; then
   echo "Smoke test failed: $fail failed, $pass passed" >&2