diff --git a/app_server.py b/app_server.py
index d523c53..e9cc0e7 100644
--- a/app_server.py
+++ b/app_server.py
@@ -34,10 +34,11 @@ DB_HOST = os.environ.get('DB_HOST', 'pss404gosg8oo0o8k40o4wco')
 DB_PORT = int(os.environ.get('DB_PORT', '5432'))
 DB_NAME = os.environ.get('DB_NAME', 'extension_platform')
 DB_USER = os.environ.get('DB_USER', 'postgres')
-DB_PASS = os.environ.get('DB_PASS', '9cugHhKR8bCFXzm')
+# Required env vars — fail fast if missing rather than fall back to a baked-in secret.
+DB_PASS = os.environ['DB_PASS']
 
 GITEA_URL = os.environ.get('GITEA_URL', 'https://gitea.dev.marcus-law.co.il')
-GITEA_TOKEN = os.environ.get('GITEA_TOKEN', '90acb3ebc0f98edfb7a373ef9902bde1cc8eff96')
+GITEA_TOKEN = os.environ['GITEA_TOKEN']
 GITEA_ORG = os.environ.get('GITEA_ORG', 'espocrm-extensions')
 
 DIST_DIR = os.environ.get('DIST_DIR', '/app/dashboard/dist')