diff --git a/dental-server/bkp/docs/EXEMPLO-ENV.txt b/dental-server/bkp/docs/EXEMPLO-ENV.txt
index e6fc833..ed50992 100644
--- a/dental-server/bkp/docs/EXEMPLO-ENV.txt
+++ b/dental-server/bkp/docs/EXEMPLO-ENV.txt
@@ -9,9 +9,9 @@
 PORT=3000
 NODE_ENV=production
 
-# Chaves JWT já geradas (64 caracteres hex cada)
-JWT_SECRET=9f8e7d6c5b4a39281802384f5e6d7c8b9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5
-SESSION_SECRET=a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0
+# Chaves JWT — gerar e DEFINIR NO .secrets (fora do git). NÃO commitar valores reais.
+JWT_SECRET=__DEFINIR_NO_.secrets__
+SESSION_SECRET=__DEFINIR_NO_.secrets__
 
 # Configure seu MySQL (AJUSTE APENAS A SENHA!)
 DB_HOST=localhost
diff --git a/dental-server/test-db2.js b/dental-server/test-db2.js
index 48a2cb4..8f13eea 100644
--- a/dental-server/test-db2.js
+++ b/dental-server/test-db2.js
@@ -3,12 +3,12 @@ const pool = new Pool({
     host: '10.99.0.3',
     port: 5432,
     user: 'clube67',
-    password: 'clube67_db_pass_9903',
+    password: process.env.DB_PASSWORD, // NÃO hardcodar segredo
     database: 'dental_images'
 });
 
 async function test() {
-  const token = 'bab18d5a-09af-4759-b742-4e1eeb651694';
+  const token = process.env.TEST_MACHINE_TOKEN || ''; // não hardcodar machine_token
   const email = 'ruibto@gmail.com';
   console.log("Looking up token:", token);
   const res = await pool.query(`SELECT * FROM clinics_devices WHERE machine_token = $1`, [token]);