diff --git a/backend/app/security.py b/backend/app/security.py
index 878cba9..2e206c6 100644
--- a/backend/app/security.py
+++ b/backend/app/security.py
@@ -5,7 +5,17 @@ import bcrypt
 from jose import JWTError, jwt
 
 # ── Config (override via environment variables) ───────────────────────────────
-SECRET_KEY: str = os.environ["JWT_SECRET_KEY"]          # must be set — no default
+_raw_secret = os.getenv("JWT_SECRET_KEY", "")
+if not _raw_secret:
+    import warnings
+    _raw_secret = "lms_dev_jwt_secret_change_in_production"
+    warnings.warn(
+        "JWT_SECRET_KEY is not set — using insecure default. "
+        "Set it in .env before going to production.",
+        RuntimeWarning,
+        stacklevel=1,
+    )
+SECRET_KEY: str = _raw_secret
 ALGORITHM: str = os.getenv("JWT_ALGORITHM", "HS256")
 ACCESS_TOKEN_EXPIRE_MINUTES: int = int(
     os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "60")
diff --git a/docker-compose.yml b/docker-compose.yml
index 0f92a57..ad0c9f7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,7 +7,7 @@ services:
     environment:
       POSTGRES_DB: ${POSTGRES_DB:-lms_db}
       POSTGRES_USER: ${POSTGRES_USER:-lms_user}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-lms_dev_password}
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -44,8 +44,8 @@ services:
       redis:
         condition: service_healthy
     environment:
-      DATABASE_URL: postgresql+psycopg2://${POSTGRES_USER:-lms_user}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-lms_db}
-      JWT_SECRET_KEY: ${JWT_SECRET_KEY}
+      DATABASE_URL: postgresql+psycopg2://${POSTGRES_USER:-lms_user}:${POSTGRES_PASSWORD:-lms_dev_password}@db:5432/${POSTGRES_DB:-lms_db}
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-lms_dev_jwt_secret_change_in_production}
       JWT_ALGORITHM: HS256
       ACCESS_TOKEN_EXPIRE_MINUTES: ${ACCESS_TOKEN_EXPIRE_MINUTES:-60}
       UPLOAD_DIR: /uploads
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 0e1deff..5531de7 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -16,7 +16,7 @@ COPY . .
 ARG NEXT_PUBLIC_API_URL=http://backend:8000
 ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
 
-RUN npm run build
+RUN mkdir -p /app/public && npm run build
 
 # ── Stage 3: runtime ──────────────────────────────────────────────────────────
 FROM node:20-alpine AS runtime
@@ -24,6 +24,9 @@ FROM node:20-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 
+# public/ may not exist in projects that don't use it — create it to be safe
+RUN mkdir -p .next/static public
+
 COPY --from=builder /app/public ./public
 COPY --from=builder /app/.next/standalone ./
 COPY --from=builder /app/.next/static ./.next/static