diff --git a/.gitignore b/.gitignore
index 1ec8866..beebcc1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,4 @@ __pycache__
 .DS_Store
 *.html
 logs
-envs/dev/.env
+envs/*/.env
diff --git a/README.md b/README.md
index 94dd49a..17c7c1e 100644
--- a/README.md
+++ b/README.md
@@ -9,21 +9,27 @@ Brief, copy/paste-ready steps to run the published images from `gitea.04080616.x
 
 ## Environment configs
 
-Pre-configured `.env` files for each deployment are in the `envs/` folder:
+Per-deployment templates live in `envs/<name>/.env.example` (committed). Each operator copies the example to a sibling `.env` (gitignored — never committed) and fills in the real secrets:
+
 ```
 envs/
-├── rex/.env      # Rex deployment (port 8001)
-└── siong/.env    # Siong deployment (port 8005)
+├── dev/.env.example      # Local development tier — see "Local Development" below
+├── rex/.env.example      # Rex deployment (port 8001)
+└── siong/.env.example    # Siong deployment (port 8005)
 ```
 
-For local development, copy the desired env to the project root:
+For Portainer-hosted deployments (rex/siong):
 ```bash
-cp envs/rex/.env .env
-# or
-cp envs/siong/.env .env
+cp envs/rex/.env.example envs/rex/.env
+# Fill in DB_PASSWORD, CM_AGENT_*, CM_SECURITY_PIN, TELEGRAM_BOT_TOKEN, etc.
+# Then load the variables into the Portainer stack environment.
 ```
 
-For Portainer, load the env vars from the appropriate file into the stack environment variables.
+For local development, see the dev tier flow:
+```bash
+cp envs/dev/.env.example .env
+bash scripts/dev.sh up
+```
 
 ## Key variables
 | Variable | Description |
diff --git a/envs/rex/.env b/envs/rex/.env
deleted file mode 100644
index 7825c36..0000000
--- a/envs/rex/.env
+++ /dev/null
@@ -1,28 +0,0 @@
-# === Deployment Identity ===
-CM_DEPLOY_NAME=rex-cm
-CM_WEB_HOST_PORT=8001
-
-# === Docker Registry ===
-CM_IMAGE_PREFIX=gitea.04080616.xyz/yiekheng
-DOCKER_IMAGE_TAG=latest
-
-# === Telegram ===
-TELEGRAM_BOT_TOKEN=5315819168:AAH31xwNgPdnk123x97XalmTW6fQV5EUCFU
-TELEGRAM_ALERT_CHAT_ID=818380985
-
-# === Database ===
-DB_HOST=192.168.0.210
-DB_USER=rex_cm
-DB_PASSWORD=hengserver
-DB_NAME=rex_cm
-DB_PORT=3306
-DB_CONNECTION_TIMEOUT=8
-DB_CONNECT_RETRIES=5
-DB_CONNECT_RETRY_DELAY=2
-
-# === Bot Config ===
-CM_PREFIX_PATTERN=13c
-CM_AGENT_ID=cm13a3
-CM_AGENT_PASSWORD=Sky533535
-CM_SECURITY_PIN=Sky533535
-CM_BOT_BASE_URL=https://cm99.net
diff --git a/envs/rex/.env.example b/envs/rex/.env.example
new file mode 100644
index 0000000..e99161b
--- /dev/null
+++ b/envs/rex/.env.example
@@ -0,0 +1,38 @@
+# rex deployment template. Copy to envs/rex/.env (which is gitignored) and
+# fill in the real secrets for the rex environment, OR paste the variables
+# directly into the Portainer stack environment.
+
+# === Runtime ===
+# Leave unset (or 'false') in production. Setting CM_DEBUG=true exposes the
+# Werkzeug debugger and is RCE if the port is reachable.
+CM_DEBUG=false
+
+# === Deployment Identity ===
+CM_DEPLOY_NAME=rex-cm
+CM_WEB_HOST_PORT=8001
+
+# === Docker Registry / Build ===
+CM_IMAGE_PREFIX=gitea.04080616.xyz/yiekheng
+DOCKER_IMAGE_TAG=latest
+
+# === Telegram ===
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_ALERT_CHAT_ID=
+TELEGRAM_ALERT_BOT_TOKEN=
+
+# === Database ===
+DB_HOST=
+DB_USER=
+DB_PASSWORD=
+DB_NAME=
+DB_PORT=3306
+DB_CONNECTION_TIMEOUT=8
+DB_CONNECT_RETRIES=5
+DB_CONNECT_RETRY_DELAY=2
+
+# === Bot Config ===
+CM_PREFIX_PATTERN=
+CM_AGENT_ID=
+CM_AGENT_PASSWORD=
+CM_SECURITY_PIN=
+CM_BOT_BASE_URL=
diff --git a/envs/siong/.env b/envs/siong/.env
deleted file mode 100644
index 299678f..0000000
--- a/envs/siong/.env
+++ /dev/null
@@ -1,28 +0,0 @@
-# === Deployment Identity ===
-CM_DEPLOY_NAME=siong-cm
-CM_WEB_HOST_PORT=8005
-
-# === Docker Registry ===
-CM_IMAGE_PREFIX=gitea.04080616.xyz/yiekheng
-DOCKER_IMAGE_TAG=latest
-
-# === Telegram ===
-TELEGRAM_BOT_TOKEN=7028479329:AAH_UTPoYcaB0iZMXJjO7pKYxyub8ZSXn2E
-TELEGRAM_ALERT_CHAT_ID=818380985
-
-# === Database ===
-DB_HOST=192.168.0.210
-DB_USER=siong_cm
-DB_PASSWORD=hengserver
-DB_NAME=siong_cm
-DB_PORT=3306
-DB_CONNECTION_TIMEOUT=8
-DB_CONNECT_RETRIES=5
-DB_CONNECT_RETRY_DELAY=2
-
-# === Bot Config ===
-CM_PREFIX_PATTERN=13sa
-CM_AGENT_ID=cm13a39
-CM_AGENT_PASSWORD=Wenwen12345
-CM_SECURITY_PIN=Wenwen12345
-CM_BOT_BASE_URL=https://cm99.net
diff --git a/envs/siong/.env.example b/envs/siong/.env.example
new file mode 100644
index 0000000..5be804a
--- /dev/null
+++ b/envs/siong/.env.example
@@ -0,0 +1,38 @@
+# siong deployment template. Copy to envs/siong/.env (which is gitignored) and
+# fill in the real secrets for the siong environment, OR paste the variables
+# directly into the Portainer stack environment.
+
+# === Runtime ===
+# Leave unset (or 'false') in production. Setting CM_DEBUG=true exposes the
+# Werkzeug debugger and is RCE if the port is reachable.
+CM_DEBUG=false
+
+# === Deployment Identity ===
+CM_DEPLOY_NAME=siong-cm
+CM_WEB_HOST_PORT=8005
+
+# === Docker Registry / Build ===
+CM_IMAGE_PREFIX=gitea.04080616.xyz/yiekheng
+DOCKER_IMAGE_TAG=latest
+
+# === Telegram ===
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_ALERT_CHAT_ID=
+TELEGRAM_ALERT_BOT_TOKEN=
+
+# === Database ===
+DB_HOST=
+DB_USER=
+DB_PASSWORD=
+DB_NAME=
+DB_PORT=3306
+DB_CONNECTION_TIMEOUT=8
+DB_CONNECT_RETRIES=5
+DB_CONNECT_RETRY_DELAY=2
+
+# === Bot Config ===
+CM_PREFIX_PATTERN=
+CM_AGENT_ID=
+CM_AGENT_PASSWORD=
+CM_SECURITY_PIN=
+CM_BOT_BASE_URL=