diff --git a/.env.example b/.env.example
index 241629c..3bb74b5 100644
--- a/.env.example
+++ b/.env.example
@@ -1,54 +1,48 @@
 # EuchreCamp Environment Configuration
-# Copy this file to .env and fill in your values
+# ============================================
+# Copy this file to .env (for local dev) or use
+# .env.development / .env.ci for specific environments
 
 # ============================================
 # Database Configuration
 # ============================================
-# PostgreSQL connection string
-# Format: postgresql://username:password@host:port/database
-DATABASE_URL=postgresql://euchre:euchrepassword@localhost:5432/euchre_camp
+# IMPORTANT: Use the appropriate DATABASE_URL for your environment:
+#
+# - Development (ephemeral, synced from prod):  euchre_camp_dev
+# - CI/Testing (reset before each run):        euchre_camp_ci  
+# - Production (DO NOT USE FOR TESTS):         euchre_camp
+#
+# The .credentials file in the project root contains
+# the actual connection strings - DO NOT commit .credentials
 
-# Shadow database for Prisma migrations (optional for PostgreSQL)
-DATABASE_SHADOW_URL=postgresql://euchre:euchrepassword@localhost:5432/euchre_camp_shadow
-
-# Database provider (postgresql)
 DATABASE_PROVIDER=postgresql
 
 # ============================================
 # Better Auth Configuration
 # ============================================
-# Secret key for session encryption (generate a strong random string)
-# Run: openssl rand -base64 32
-BETTER_AUTH_SECRET=your-secret-key-change-in-production
+# Generate a new secret with: openssl rand -base64 32
+BETTER_AUTH_SECRET=generate-new-secret-in-production
 
-# Base URL for authentication callbacks
-# For production: https://your-domain.com
+# Base URL - update for production
 BETTER_AUTH_URL=http://localhost:3000
 
 # ============================================
 # Application Configuration
 # ============================================
-# Environment: development, production, test
-NODE_ENV=production
+NODE_ENV=development
 
-# Trusted origins for CORS and authentication
-# Add your domain(s) for production
+# Comma-separated list of trusted origins
 TRUSTED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
 
 # ============================================
-# Optional: External Services
+# Environment-Specific Overrides
 # ============================================
-# If using external database (e.g., Supabase, Railway)
-# DATABASE_URL=postgresql://user:pass@host:port/db
-
-# If using external auth provider
-# BETTER_AUTH_URL=https://your-app.com
-
-# ============================================
-# CasaOS Deployment Notes
-# ============================================
-# When deploying to CasaOS, set these via the UI:
-# 1. DATABASE_URL: Your PostgreSQL connection string
-# 2. BETTER_AUTH_SECRET: Generate with: openssl rand -base64 32
-# 3. BETTER_AUTH_URL: Your app's public URL
-# 4. TRUSTED_ORIGINS: Your app's public URL(s)
+# For development (.env.development):
+#   DATABASE_URL from .credentials (euchre_camp_dev)
+#   NODE_ENV=development
+#   BETTER_AUTH_URL=http://localhost:3000
+#
+# For CI (.env.ci):
+#   DATABASE_URL from .credentials (euchre_camp_ci)
+#   NODE_ENV=test
+#   BETTER_AUTH_URL=http://localhost:3000
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 6a67180..1d25ec2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -59,3 +59,4 @@ playwright-report/
 
 cucumber-pretty
 .env.production
+.credentials