diff --git a/.env.example b/.env.example
index 2fe0356..d911a40 100644
--- a/.env.example
+++ b/.env.example
@@ -20,3 +20,14 @@ VIKUNJA_SERVICE_PUBLICURL=http://vikunja.your-tailnet.ts.net
 
 # Frontend URL (usually the same as PUBLICURL)
 VIKUNJA_SERVICE_FRONTENDURL=http://vikunja.your-tailnet.ts.net
+
+# ==========================================
+# Database Configuration (Vikunja)
+# ==========================================
+
+VIKUNJA_DATABASE_USER=vikunja
+VIKUNJA_DATABASE_PASSWORD=change-me
+VIKUNJA_DATABASE_DATABASE=vikunja
+
+# Vikunja JWT secret (change this!)
+VIKUNJA_SERVICE_JWTSECRET=change-me
diff --git a/SECURITY.md b/SECURITY.md
index 464499b..83e99da 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -28,3 +28,12 @@ The `docker-compose.yml` file contains placeholder values (`***`) for sensitive
 - Vikunja JWT secret
 
 **Change these values** before deploying anywhere security matters. Never use the default placeholders in production or shared environments.
+
+## Environment File
+
+The `.env` file now contains additional sensitive values including:
+
+- Database credentials
+- Vikunja JWT secret
+
+**Never commit your `.env` file.** Always use `.env.example` as a template and keep real values private.
diff --git a/docker-compose.yml b/docker-compose.yml
index 6adb7d0..675a4bd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -36,10 +36,10 @@ services:
     environment:
       VIKUNJA_DATABASE_TYPE: postgres
       VIKUNJA_DATABASE_HOST: 127.0.0.1
-      VIKUNJA_DATABASE_USER: vikunja
-      VIKUNJA_DATABASE_PASSWORD: testpassword123
-      VIKUNJA_DATABASE_DATABASE: vikunja
-      VIKUNJA_SERVICE_JWTSECRET: testpassword123
+      VIKUNJA_DATABASE_USER: ${VIKUNJA_DATABASE_USER}
+      VIKUNJA_DATABASE_PASSWORD: ${VIKUNJA_DATABASE_PASSWORD}
+      VIKUNJA_DATABASE_DATABASE: ${VIKUNJA_DATABASE_DATABASE}
+      VIKUNJA_SERVICE_JWTSECRET: ${VIKUNJA_SERVICE_JWTSECRET}
       VIKUNJA_SERVICE_PUBLICURL: ${VIKUNJA_SERVICE_PUBLICURL}
       VIKUNJA_SERVICE_FRONTENDURL: ${VIKUNJA_SERVICE_FRONTENDURL}
     volumes: