diff --git a/11_compose/11.8_wordpress.md b/11_compose/11.8_wordpress.md
index c80755f..1c95dd3 100644
--- a/11_compose/11.8_wordpress.md
+++ b/11_compose/11.8_wordpress.md
@@ -21,7 +21,7 @@ wordpress/
 
 ### 11.8.2 编写 `compose.yaml`
 
-这是一个生产可用的最小化配置：
+这是一个可运行的单机最小配置，不是完整生产安全基线。正式部署前应固定镜像版本、放在反向代理/TLS 后面、限制公开端口、配置备份与监控，并按 WordPress 与插件生命周期做升级测试。
 
 ```yaml
 services:
@@ -50,11 +50,13 @@ services:
   # WordPress 服务
 
   wordpress:
+    # 示例保留 latest 以便读者快速体验；生产环境请固定到经过测试的明确版本标签
     image: wordpress:latest
     container_name: wordpress_app
     restart: always
     ports:
-      - "8000:80"
+      # 本机调试入口；生产环境请通过反向代理发布 HTTPS
+      - "127.0.0.1:8000:80"
     environment:
       WORDPRESS_DB_HOST: db:3306
       WORDPRESS_DB_USER: wordpress
diff --git a/14_kubernetes_setup/14.7_dashboard.md b/14_kubernetes_setup/14.7_dashboard.md
index 7083bb2..a937443 100644
--- a/14_kubernetes_setup/14.7_dashboard.md
+++ b/14_kubernetes_setup/14.7_dashboard.md
@@ -29,14 +29,20 @@ $ kubectl -n kubernetes-dashboard port-forward svc/kubernetes-dashboard-kong-pro
 
 ### 14.7.3 登录
 
-创建管理员服务账户并获取登录令牌：
+为历史 Dashboard 创建只读服务账户并获取短期登录令牌。不要为 Dashboard 创建 `cluster-admin` 绑定；如果确实需要临时管理员权限，应走单独的 break-glass 审批和审计流程。
 
 ```bash
-$ kubectl create sa dashboard-admin -n kubernetes-dashboard
+$ kubectl create sa dashboard-readonly -n kubernetes-dashboard
 
-$ kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:dashboard-admin
+$ kubectl create clusterrole dashboard-readonly \
+  --verb=get,list,watch \
+  --resource=pods,deployments,services,configmaps,namespaces,nodes
 
-$ kubectl create token dashboard-admin -n kubernetes-dashboard
+$ kubectl create clusterrolebinding dashboard-readonly \
+  --clusterrole=dashboard-readonly \
+  --serviceaccount=kubernetes-dashboard:dashboard-readonly
+
+$ kubectl create token dashboard-readonly -n kubernetes-dashboard --duration=1h
 ```
 
 将输出的令牌粘贴到登录页面，即可登录。
diff --git a/18_security/18.6_image_security.md b/18_security/18.6_image_security.md
index a97060b..81211ab 100644
--- a/18_security/18.6_image_security.md
+++ b/18_security/18.6_image_security.md
@@ -298,8 +298,8 @@ docker push --disable-content-trust myregistry.com/myapp:v1.0.0
 # 首次推送时会提示创建 Delegation Key
 # 密钥存储在 ~/.docker/trust/private/root_keys/ 和 ~/.docker/trust/private/tuf_keys/
 
-# 查看签名信息
-docker inspect --format='{{.RepoDigests}}' myregistry.com/myapp:v1.0.0
+# 查看 DCT/Notary 信任数据；RepoDigests 只是内容摘要，不等于签名验证
+docker trust inspect --pretty myregistry.com/myapp:v1.0.0
 ```
 
 ### 18.6.4 供应链安全最佳实践
diff --git a/21_case_devops/21.7_practical_examples.md b/21_case_devops/21.7_practical_examples.md
index 530c6dc..3d821a3 100644
--- a/21_case_devops/21.7_practical_examples.md
+++ b/21_case_devops/21.7_practical_examples.md
@@ -362,13 +362,14 @@ services:
     environment:
       POSTGRES_DB: myappdb
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres_password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
       POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=en_US.UTF-8"
     volumes:
       - postgres_data:/var/lib/postgresql/data
       - ./backups:/backups
     ports:
-      - "5432:5432"
+      # 只暴露给本机调试；生产环境优先不发布数据库端口
+      - "127.0.0.1:5432:5432"
     networks:
       - backend
     restart: unless-stopped
@@ -384,7 +385,7 @@ services:
     depends_on:
       - postgres
     environment:
-      PGPASSWORD: postgres_password
+      PGPASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
     volumes:
       - ./backups:/backups
     command: |