diff --git a/server/.env.example b/server/.env.example
index e4629685..16317239 100644
--- a/server/.env.example
+++ b/server/.env.example
@@ -1,6 +1,10 @@
+# PostgreSQL (docker-compose)
+POSTGRES_PASSWORD=CHANGE_ME
+
+# Application
 debug=false
 url_prefix=/api
-secret_key=postgres
+secret_key=CHANGE_ME
 # Chat Share Secret Key
 CHAT_SHARE_SECRET_KEY=put-your-secret-key-here
 CHAT_SHARE_SALT=put-your-encode-salt-here
diff --git a/server/.gitignore b/server/.gitignore
index 565fdf76..3ced7486 100644
--- a/server/.gitignore
+++ b/server/.gitignore
@@ -13,3 +13,9 @@ wheels/
 runtime
 
 app/public/upload/
+
+# Environment files with sensitive data
+.env
+
+# Alembic config with credentials
+alembic.ini
diff --git a/server/docker-compose.dev.yml b/server/docker-compose.dev.yml
index 15685f03..6275864b 100644
--- a/server/docker-compose.dev.yml
+++ b/server/docker-compose.dev.yml
@@ -7,7 +7,7 @@ services:
     environment:
       POSTGRES_DB: eigent
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: 123456
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-123456}
       POSTGRES_INITDB_ARGS: '--encoding=UTF-8 --lc-collate=C --lc-ctype=C'
     ports:
       - '5432:5432'
diff --git a/server/docker-compose.yml b/server/docker-compose.yml
index a777a790..36e4f459 100644
--- a/server/docker-compose.yml
+++ b/server/docker-compose.yml
@@ -7,7 +7,7 @@ services:
     environment:
       POSTGRES_DB: eigent
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: 123456
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-123456}
       POSTGRES_INITDB_ARGS: '--encoding=UTF-8 --lc-collate=C --lc-ctype=C'
     ports:
       - '5432:5432'
@@ -44,7 +44,7 @@ services:
       context: ..
       dockerfile: server/Dockerfile
       args:
-        database_url: postgresql://postgres:123456@postgres:5432/eigent
+        database_url: postgresql://postgres:${POSTGRES_PASSWORD:-123456}@postgres:5432/eigent
     container_name: eigent_api
     restart: unless-stopped
     ports:
@@ -52,7 +52,7 @@ services:
     env_file:
       - .env
     environment:
-      - database_url=postgresql://postgres:123456@postgres:5432/eigent
+      - database_url=postgresql://postgres:${POSTGRES_PASSWORD:-123456}@postgres:5432/eigent
       - redis_url=redis://redis:6379/0
       - celery_broker_url=redis://redis:6379/0
       - celery_result_url=redis://redis:6379/0
@@ -82,14 +82,14 @@ services:
       context: ..
       dockerfile: server/Dockerfile
       args:
-        database_url: postgresql://postgres:123456@postgres:5432/eigent
+        database_url: postgresql://postgres:${POSTGRES_PASSWORD:-123456}@postgres:5432/eigent
     container_name: eigent_celery_worker
     restart: unless-stopped
     command: /app/celery/worker/start
     env_file:
       - .env
     environment:
-      - database_url=postgresql://postgres:123456@postgres:5432/eigent
+      - database_url=postgresql://postgres:${POSTGRES_PASSWORD:-123456}@postgres:5432/eigent
       - redis_url=redis://redis:6379/0
       - celery_broker_url=redis://redis:6379/0
       - celery_result_url=redis://redis:6379/0
@@ -120,14 +120,14 @@ services:
       context: ..
       dockerfile: server/Dockerfile
       args:
-        database_url: postgresql://postgres:123456@postgres:5432/eigent
+        database_url: postgresql://postgres:${POSTGRES_PASSWORD:-123456}@postgres:5432/eigent
     container_name: eigent_celery_beat
     restart: unless-stopped
     command: /app/celery/beat/start
     env_file:
       - .env
     environment:
-      - database_url=postgresql://postgres:123456@postgres:5432/eigent
+      - database_url=postgresql://postgres:${POSTGRES_PASSWORD:-123456}@postgres:5432/eigent
       - redis_url=redis://redis:6379/0
       - celery_broker_url=redis://redis:6379/0
       - celery_result_url=redis://redis:6379/0