diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3439635a..9ea5631f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,20 +61,22 @@ jobs:
       uses: actions/download-artifact@v3
       with:
         name: biliroaming-rust-server-${{ github.run_number }}
-    - name: Delete old release assets
-      uses: mknejp/delete-release-assets@v1
-      with:
-        token: ${{ github.token }}
-        tag: alpha-releases
-        assets: |
-          biliroaming_rust_server
-    - name: Release
-      uses: softprops/action-gh-release@v1
+    - name: Update Alpha Release
+      uses: mini-bomba/create-github-release@v1.1.3
       with:
+        token: ${{ secrets.GITHUB_TOKEN }}
         prerelease: true
-        tag_name: alpha-releases
+        tag: alpha-releases
+        name: Alpha-Release
+        body: |
+            This automatic prerelease is built from commit ${{ env.GIT_HASH }} and was triggered by @${{ github.actor }}
+            [Github Actions workflow run that built this prerelease](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+
+            Commit message:
+            ${{ env.GIT_MESSAGE }}
         files: |
           ./biliroaming_rust_server
+        clear_attachments: true
 
   release:
     name: Upload the binary file when it is released
diff --git a/src/mods/handler.rs b/src/mods/handler.rs
index a4362f76..9deaec30 100644
--- a/src/mods/handler.rs
+++ b/src/mods/handler.rs
@@ -409,7 +409,8 @@ pub async fn handle_search_request(req: &HttpRequest, is_app: bool, is_th: bool)
     // detect user's access_key
     params.access_key = match query.get("access_key") {
         Some(key) => {
-            if key.len() != 32 && key.len() != 107 {
+            if key.len() < 32 {
+                error!("[GET SEARCH] IP {client_ip} -> Detect req with invalid access_key {key}");
                 build_response!(EType::UserNotLoginedError);
             } else {
                 key.split_at(32).0
@@ -614,7 +615,8 @@ pub async fn handle_th_season_request(
     // detect user's access_key
     params.access_key = match query.get("access_key") {
         Some(key) => {
-            if key.len() != 32 && key.len() != 107 {
+            if key.len() < 32 {
+                error!("[GET TH SEASON] IP {client_ip} -> Detect req with invalid access_key {key}");
                 build_response!(EType::UserNotLoginedError);
             } else {
                 key.split_at(32).0