chore: tighten compose defaults and add security checklist

Author: root

CONTRIBUTING.md

@@ -55,6 +55,13 @@ pnpm --filter web build
 - No secrets or credentials committed
 - Updated README/docs if behavior changed
 
+## Security Checklist
+- Never commit `.env` or real credentials
+- Use placeholders or local-only values for compose/dev configs
+- Avoid logging tokens or sensitive payloads
+- Rotate keys immediately if a secret is exposed
+- Keep dependencies updated and audited
+
 ## Reporting Issues
 When filing a bug, include:
 - Reproduction steps

docker-compose.yml

@@ -4,9 +4,9 @@ services:
     image: postgres:16-alpine
     container_name: fairshare-postgres
     environment:
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
-      POSTGRES_DB: fairshare
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
+      POSTGRES_DB: ${POSTGRES_DB:-fairshare}
     ports:
       - "5432:5432"
     volumes: