security update

.env.example

@@ -1,26 +1,29 @@
 # Server Configuration
 API_PORT=8080
-ENVIRONMENT=development
+ENVIRONMENT=production  # IMPORTANT: Set to 'production' in production!
 
 # Security - REQUIRED
-# Generate a strong random API key (e.g., using: openssl rand -base64 32)
-API_KEY=your-super-secret-api-key-here
+API_KEY=CHANGE-THIS-USE-32-CHARS-MINIMUM!!
+
+# CORS Configuration
+CORS_ALLOWED_ORIGINS=http://localhost:3000
 
 # Vaultwarden Configuration - REQUIRED
 # URL of your Vaultwarden instance (no trailing slash)
 VAULTWARDEN_URL=https://vault.yourdomain.com
 
-# Vaultwarden API access token
-# Get this from: Vaultwarden > Settings > Security > API Key
-# Or create via CLI: vaultwarden hash --preset <preset>
-VAULTWARDEN_ACCESS_TOKEN=your-vaultwarden-access-token
+# Authentication Method 1: API Keys (RECOMMENDED - doesn't expire)
+VAULTWARDEN_CLIENT_ID=user.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+VAULTWARDEN_CLIENT_SECRET=your-long-client-secret-here
+
+# Authentication Method 2: Session Token (LEGACY - expires after some time)
+# VAULTWARDEN_ACCESS_TOKEN=your-session-token-here
 
 # Performance & Caching
 # How long to cache secrets in memory (reduces API calls)
-# Set to 0 to disable caching
+# Set to 0 to disable caching (more secure but slower)
 CACHE_TTL=5m
 
 # Timeouts
 READ_TIMEOUT=10s
-WRITE_TIMEOUT=10s
-
+WRITE_TIMEOUT=10s