diff --git a/tenant-service/src/main/java/com/xuqm/tenant/controller/SdkConfigController.java b/tenant-service/src/main/java/com/xuqm/tenant/controller/SdkConfigController.java
index 55c97c9..335c12d 100644
--- a/tenant-service/src/main/java/com/xuqm/tenant/controller/SdkConfigController.java
+++ b/tenant-service/src/main/java/com/xuqm/tenant/controller/SdkConfigController.java
@@ -85,13 +85,19 @@ public class SdkConfigController {
         JsonNode pushConfig;
         if (rawPushConfig.has("vendors") && rawPushConfig.path("vendors").isObject()) {
             com.fasterxml.jackson.databind.node.ObjectNode flat = objectMapper.createObjectNode();
-            rawPushConfig.path("vendors").fields().forEachRemaining(e -> flat.set(e.getKey(), e.getValue()));
+            rawPushConfig.path("vendors").fields().forEachRemaining(e -> flat.set(e.getKey(), e.getValue().deepCopy()));
             if (rawPushConfig.has("profiles")) {
                 flat.set("profiles", rawPushConfig.get("profiles"));
             }
             pushConfig = flat;
         } else {
-            pushConfig = rawPushConfig;
+            pushConfig = rawPushConfig.deepCopy();
+        }
+        // This endpoint is public and consumed by client SDKs. OPPO masterSecret is
+        // exclusively a server-side API credential; the Android SDK only needs appSecret.
+        if (pushConfig.isObject() && pushConfig.path("oppo").isObject()) {
+            ((com.fasterxml.jackson.databind.node.ObjectNode) pushConfig.path("oppo"))
+                    .remove("masterSecret");
         }
         boolean updateEnabled = deployProps.isEnableUpdate() && featureServiceRepository
                 .findByAppKeyAndPlatformAndServiceType(app.getAppKey(), platform, FeatureServiceEntity.ServiceType.UPDATE)