diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4c49bd7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/docker-compose.yml b/docker-compose.yml
index 9928c3e..d77ca19 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,7 +9,12 @@ services:
       - ./ems-backend/json-db:/app/json-db
       - ./ems-backend/uploads:/app/uploads
     environment:
-      APP_BASE_URL: http://localhost:5173
+      APP_BASE_URL: ${APP_BASE_URL:-http://localhost:5173}
+      TOKEN_SIGNING_KEY: ${TOKEN_SIGNING_KEY:-}
+      JWT_SECRET: ${JWT_SECRET:-}
+      VOLCANO_API_KEY: ${VOLCANO_API_KEY:-}
+      SPRING_MAIL_USERNAME: ${SPRING_MAIL_USERNAME:-}
+      SPRING_MAIL_PASSWORD: ${SPRING_MAIL_PASSWORD:-}
   frontend:
     build:
       context: ./ems-frontend/ems-monitoring-system
diff --git a/ems-backend/src/main/resources/application.properties b/ems-backend/src/main/resources/application.properties
index 6d337e3..9e2af0a 100644
--- a/ems-backend/src/main/resources/application.properties
+++ b/ems-backend/src/main/resources/application.properties
@@ -8,13 +8,13 @@ file.upload-dir=./uploads
 # A secure key for signing JWT tokens. 
 # This should be a long, random, Base64-encoded string.
 # For production, this should be stored securely (e.g., as an environment variable).
-token.signing.key=Njc4MjQ2NzM1NzY1NjE0MzU0Njc1NjY5MzIzNTMzNTg0MjM0NTM0NTM0NTM0MzQ1MzQ1MzQ1MzQ1MzQ1MzQ1MzQ1
+token.signing.key=${TOKEN_SIGNING_KEY:dev-change-me}
 
 # ===================================================================
 # c. Volcano Engine AI Service Configuration
 # ===================================================================
 volcano.api.url=https://ark.cn-beijing.volces.com/api/v3/chat/completions
-volcano.api.key=4ba6ef42-2b1f-4961-a6a9-bf232c4153af
+volcano.api.key=${VOLCANO_API_KEY:}
 volcano.model.name=deepseek-v3-250324
 
 # ===================================================================
@@ -28,15 +28,15 @@ spring.aop.proxy-target-class=true
 # ===================================================================
 # This URL is used to construct absolute URLs for resources like uploaded files.
 # It should be the public-facing base URL of the application.
-app.base.url=http://localhost:5173
+app.base.url=${APP_BASE_URL:http://localhost:5173}
 
 # ===================================================================
 # Mail Configuration for 163 SMTP
 # ===================================================================
 spring.mail.host=smtp.163.com
 spring.mail.port=465
-spring.mail.username=wanyizhou20251@163.com
-spring.mail.password=DTjbrbckcszsEjzz
+spring.mail.username=${SPRING_MAIL_USERNAME:}
+spring.mail.password=${SPRING_MAIL_PASSWORD:}
 spring.mail.properties.mail.smtp.auth=true
 spring.mail.properties.mail.smtp.ssl.enable=true
 spring.mail.properties.mail.smtp.socketFactory.class=javax.net.ssl.SSLSocketFactory
@@ -61,7 +61,7 @@ logging.level.org.hibernate=WARN
 # ===================================================================
 # JWT Configuration
 # ===================================================================
-jwt.secret=EmS2023SecretKeyForJWTToKen1234567890
+jwt.secret=${JWT_SECRET:dev-change-me}
 jwt.expiration=86400000
 
 # ===================================================================
@@ -70,4 +70,4 @@ jwt.expiration=86400000
 spring.task.execution.pool.core-size=5
 spring.task.execution.pool.max-size=10
 spring.task.execution.pool.queue-capacity=25
-spring.task.execution.thread-name-prefix=ems-async-
\ No newline at end of file
+spring.task.execution.thread-name-prefix=ems-async-