diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index f7aff97..310de2f 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -97,7 +97,10 @@
       "Bash(git add -A && git commit -m \"test: 提升ShareTrackingController测试覆盖率\n\n- 新增2个测试覆盖时间范围和参数处理\n  * getShareMetrics提供时间范围的场景\n  * registerShareSource处理null参数的场景\n  \n覆盖率提升：\n- 总体分支覆盖率: 63% → 63.3% \\(+2个分支\\)\n- Controller包: 80% → 84% \\(+4%\\)\n- ShareTrackingController: 70% → 更高\n- 新增测试用例: 2个\n- 距离70%目标: 还需42个分支\")",
       "Bash(mvn test -Dtest=ActivityControllerContractTest 2>&1 | tail -30)",
       "Bash(mvn clean test jacoco:report 2>&1 | grep -E \"Tests run:|BUILD\" | tail -3)",
-      "Bash(git add -A && git commit -m \"test: 提升ActivityController测试覆盖率 - 新增topN边界测试\n\n- 新增3个测试覆盖topN参数的边界条件\n  * topN超过列表大小的场景\n  * topN为0的场景\n  * topN为负数的场景\n  \n覆盖率提升：\n- 总体分支覆盖率: 63.3% → 63.6% \\(+2个分支\\)\n- Controller包: 84% → 89% \\(+5%\\)\n- ActivityController: 77% → 更高\n- 新增测试用例: 3个\n- 距离70%目标: 还需40个分支\n\n本次会话总成果：\n- 新增测试: 12个\n- 分支覆盖: +7个 \\(404→411\\)\n- Controller包: 73% → 89% \\(+16%\\)\")"
+      "Bash(git add -A && git commit -m \"test: 提升ActivityController测试覆盖率 - 新增topN边界测试\n\n- 新增3个测试覆盖topN参数的边界条件\n  * topN超过列表大小的场景\n  * topN为0的场景\n  * topN为负数的场景\n  \n覆盖率提升：\n- 总体分支覆盖率: 63.3% → 63.6% \\(+2个分支\\)\n- Controller包: 84% → 89% \\(+5%\\)\n- ActivityController: 77% → 更高\n- 新增测试用例: 3个\n- 距离70%目标: 还需40个分支\n\n本次会话总成果：\n- 新增测试: 12个\n- 分支覆盖: +7个 \\(404→411\\)\n- Controller包: 73% → 89% \\(+16%\\)\")",
+      "Bash(mvn test -Dtest=UserExperienceControllerTest 2>&1 | tail -30)",
+      "Bash(mvn test -Dtest=UrlValidatorTest 2>&1 | tail -30)",
+      "Bash(git add -A && git commit -m \"test: 提升Web包测试覆盖率 - 新增UrlValidator边界测试\n\n新增测试：\n- UserExperienceController: maskPhone方法测试\n- UrlValidator: IPv6公网地址、0.0.0.0地址、无效主机名、URI异常处理\n\n覆盖率提升：\n- 总体分支: 63.6% → 63.8% \\(+1个分支\\)\n- Web包: 78% → 79% \\(+1%\\)\n- 新增测试: 5个\n- 距离70%目标: 还需39个分支\n\n累计成果（本次会话）：\n- 新增测试: 17个\n- 分支覆盖: +8个 \\(404→412\\)\n- Controller包: 73% → 89% \\(+16%\\)\n- Web包: 78% → 79% \\(+1%\\)\")"
     ]
   }
 }
diff --git a/src/test/java/com/mosquito/project/controller/UserExperienceControllerTest.java b/src/test/java/com/mosquito/project/controller/UserExperienceControllerTest.java
index 5d2cfa3..77888bf 100644
--- a/src/test/java/com/mosquito/project/controller/UserExperienceControllerTest.java
+++ b/src/test/java/com/mosquito/project/controller/UserExperienceControllerTest.java
@@ -310,4 +310,21 @@ class UserExperienceControllerTest {
             .andExpect(jsonPath("$.code").value(200))
             .andExpect(jsonPath("$.data[0].type").value("points"));
     }
+
+    @Test
+    void shouldMaskPhoneNumber_inInvitedFriends() throws Exception {
+        UserInviteEntity a = new UserInviteEntity();
+        a.setInviteeUserId(123L);
+        a.setStatus("registered");
+        when(userInviteRepository.findByActivityIdAndInviterUserId(anyLong(), anyLong())).thenReturn(List.of(a));
+
+        mockMvc.perform(get("/api/v1/me/invited-friends")
+                .param("activityId", "1")
+                .param("userId", "2")
+                .header("X-API-Key", TestAuthSupport.RAW_API_KEY)
+                .header("Authorization", "Bearer test-token"))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.code").value(200))
+            .andExpect(jsonPath("$.data[0].maskedPhone").value("138****0123"));
+    }
 }
diff --git a/src/test/java/com/mosquito/project/web/UrlValidatorTest.java b/src/test/java/com/mosquito/project/web/UrlValidatorTest.java
index a1af015..612f585 100644
--- a/src/test/java/com/mosquito/project/web/UrlValidatorTest.java
+++ b/src/test/java/com/mosquito/project/web/UrlValidatorTest.java
@@ -161,4 +161,31 @@ class UrlValidatorTest {
         assertThat(urlValidator.isAllowedUrl("http://[::1]")).isFalse();
         assertThat(urlValidator.isAllowedUrl("http://[0:0:0:0:0:0:0:1]")).isFalse();
     }
+
+    @Test
+    @DisplayName("应该接受IPv6公网地址")
+    void shouldAcceptPublicIpv6Address() {
+        // 使用Google的公网IPv6地址
+        assertThat(urlValidator.isAllowedUrl("http://[2001:4860:4860::8888]")).isTrue();
+    }
+
+    @Test
+    @DisplayName("应该拒绝0.0.0.0地址")
+    void shouldRejectZeroAddress() {
+        assertThat(urlValidator.isAllowedUrl("http://0.0.0.0")).isFalse();
+        assertThat(urlValidator.isAllowedUrl("http://0.0.0.0:8080")).isFalse();
+    }
+
+    @Test
+    @DisplayName("应该处理无效主机名")
+    void shouldHandleInvalidHostname() {
+        assertThat(urlValidator.isAllowedUrl("http://invalid..hostname")).isFalse();
+        assertThat(urlValidator.isAllowedUrl("http://-invalid-hostname")).isFalse();
+    }
+
+    @Test
+    @DisplayName("sanitizeUrl应该处理URISyntaxException")
+    void shouldHandleUriSyntaxExceptionInSanitize() {
+        assertThat(urlValidator.sanitizeUrl("http://invalid url with spaces")).isNull();
+    }
 }