diff --git a/.env.example b/.env.example
index 16cb121..7c93214 100644
--- a/.env.example
+++ b/.env.example
@@ -3,8 +3,11 @@ NODE_ENV=development
 MONGODB_URI=mongodb://127.0.0.1:27017/opensquawk
 
 # Authentication
-JWT_SECRET=changeme
-JWT_REFRESH_SECRET=changeme
+# Generate strong, unique random values — e.g. `openssl rand -hex 32`.
+# The server refuses to start in production if these are unset, look like a
+# placeholder, or are shorter than 32 characters.
+JWT_SECRET=CHANGE_ME
+JWT_REFRESH_SECRET=CHANGE_ME
 
 # OpenAI
 OPENAI_API_KEY=sk-your-openai-key
@@ -23,7 +26,8 @@ USE_PIPER=false
 PIPER_PORT=5001
 SPEACHES_BASE_URL=
 SPEECH_MODEL_ID=speaches-ai/piper-en_US-ryan-low
-DOME_LIGHT_WEBHOOK_URL=https://home.io.faktorxmensch.com/api/webhook/lidl_stab_3modi_8492
+# Optional: external webhook for bridge dome-light telemetry. Leave empty to disable.
+DOME_LIGHT_WEBHOOK_URL=
 
 # Notifications
 NOTIFY_RESEND_API_KEY=
@@ -39,4 +43,10 @@ NOTIFY_SMTP_PASS=
 BOOTSTRAP_INVITE_DEADLINE=2025-09-01T00:00:00Z
 
 # Manual invitation generator
-MANUAL_INVITE_PASSWORD=pm.local@zghl.de
+MANUAL_INVITE_PASSWORD=CHANGE_ME
+
+# Cron / scheduled tasks
+# Required for the /api/service/cron/* endpoints (they send emails and mint
+# invite codes). Without it those endpoints return 503. Pass it via the
+# `x-cron-secret` header (preferred) or `?secret=` query param.
+CRON_SECRET=CHANGE_ME