HI,
Rules look fine to me, @zhd4488 and @sahostking . if you still have the test server, could you share it with support@litespeedtech.com, and I will be able to help you directly from there?
For the /vendor part is easy to secure, you can set up a static context from WebAdmin > Virtual Hosts...