diff --git a/.gitignore b/.gitignore
index b0b298e..8d4b112 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,11 @@ docker-compose.override.yml
 
 # Respaldos sintéticos para pruebas locales
 local-backups/
+
+# Certificados y llaves privadas — nunca en git
+certs/
+*.key
+*.pem
+*.crt
+*.p12
+*.pfx
diff --git a/scripts/init-database.js b/scripts/init-database.js
index 331ce27..e48f46b 100644
--- a/scripts/init-database.js
+++ b/scripts/init-database.js
@@ -7,13 +7,19 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+const pgPassword = process.env.DB_POSTGRES_PASS;
+if (!pgPassword) {
+    console.error('❌ Falta variable de entorno DB_POSTGRES_PASS. Copia .env.example → .env y configura el valor.');
+    process.exit(1);
+}
+
 // Configuración de PostgreSQL (Docker local)
 const pool = new Pool({
-    host: 'localhost',
-    port: 5432,
-    database: 'CONTROLDESK',
-    user: 'postgres',
-    password: 'Control.',
+    host: process.env.DB_POSTGRES_HOST || 'localhost',
+    port: Number(process.env.DB_POSTGRES_PORT) || 5432,
+    database: process.env.DB_POSTGRES_DB || 'CONTROLDESK',
+    user: process.env.DB_POSTGRES_USER || 'postgres',
+    password: pgPassword,
     max: 1
 });