diff --git a/.env.example b/.env.example
index e8d475d..5100acc 100644
--- a/.env.example
+++ b/.env.example
@@ -11,6 +11,19 @@ RATE_LIMIT_UPLOAD_BURST=15
 RATE_LIMIT_IMAGE_PER_SEC=10
 RATE_LIMIT_IMAGE_BURST=50
 
+# Security
+# Trusted origin for CSRF checks on write requests (POST/PUT/PATCH/DELETE).
+# Set to your production origin, e.g. https://your-domain.example.
+# Unset: falls back to the request Host header + X-Forwarded-Proto (behind a reverse proxy).
+APP_BASE_URL=
+# Set true/1/yes to add the Secure flag to the session cookie (enable in HTTPS production).
+COOKIE_SECURE=false
+# Number of reverse proxies in front of the app; used to extract the real client IP
+# from X-Forwarded-For. 0 when serving directly; 1 behind one proxy (e.g. nginx/Caddy).
+TRUSTED_PROXY_COUNT=0
+# Per-query timeout in seconds; slow queries are canceled to protect the connection pool.
+STATEMENT_TIMEOUT_SECS=30
+
 # WebP encoding configuration
 # Quality: 0.0 (smallest) to 100.0 (best), default 85.0
 WEBP_QUALITY=85.0