diff --git a/10_buildx/10.1_buildkit.md b/10_buildx/10.1_buildkit.md
index c8c614a..180bc64 100644
--- a/10_buildx/10.1_buildkit.md
+++ b/10_buildx/10.1_buildkit.md
@@ -163,4 +163,4 @@ Docker Compose 同样支持 BuildKit，这使得多服务应用的构建更加
 
 ### 10.1.3 官方文档
 
-* https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/experimental.md
+* https://docs.docker.com/reference/dockerfile/
diff --git a/11_compose/11.6_django.md b/11_compose/11.6_django.md
index 9f64bc4..7ef004a 100644
--- a/11_compose/11.6_django.md
+++ b/11_compose/11.6_django.md
@@ -116,7 +116,7 @@ services:
     environment:
       POSTGRES_DB: django_db
       POSTGRES_USER: django_user
-      POSTGRES_PASSWORD: django_password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -136,7 +136,7 @@ services:
       db:
         condition: service_healthy
     environment:
-      DATABASE_URL: postgres://django_user:django_password@db:5432/django_db
+      DATABASE_URL: postgres://django_user:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@db:5432/django_db
 
 volumes:
   postgres_data:
@@ -229,7 +229,7 @@ DATABASES = {
         'ENGINE': 'django.db.backends.postgresql',
         'NAME': os.environ.get('POSTGRES_DB', 'django_db'),
         'USER': os.environ.get('POSTGRES_USER', 'django_user'),
-        'PASSWORD': os.environ.get('POSTGRES_PASSWORD', 'django_password'),
+        'PASSWORD': os.environ['POSTGRES_PASSWORD'],
         'HOST': 'db',  # Docker Compose 服务名
         'PORT': 5432,
     }
@@ -239,6 +239,8 @@ DATABASES = {
 
 ALLOWED_HOSTS = ['*']
 ```
+
+生产环境优先使用 Docker Compose secrets 或外部密钥管理；即使是本地示例，也不要把固定密码写进 Compose 文件或 Django 默认值中。
 **为什么 HOST 是 `db` 而不是 `localhost`？**
 
 在 Docker Compose 中，各服务通过服务名相互访问。Docker 内置的 DNS 会将 `db` 解析为 db 服务容器的 IP 地址。这是 Docker Compose 的核心功能之一。
diff --git a/21_case_devops/21.7_practical_examples.md b/21_case_devops/21.7_practical_examples.md
index 5d11329..617713b 100644
--- a/21_case_devops/21.7_practical_examples.md
+++ b/21_case_devops/21.7_practical_examples.md
@@ -585,8 +585,8 @@ services:
     ports:
       - "8000:8000"
     environment:
-      DATABASE_URL: postgresql://appuser:password@postgres:5432/myappdb
-      REDIS_URL: redis://redis:6379
+      DATABASE_URL: postgresql://appuser:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/myappdb
+      REDIS_URL: redis://:${REDIS_PASSWORD:?set REDIS_PASSWORD}@redis:6379
       LOG_LEVEL: info
     depends_on:
       postgres:
@@ -618,7 +618,7 @@ services:
     environment:
       POSTGRES_DB: myappdb
       POSTGRES_USER: appuser
-      POSTGRES_PASSWORD: password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
     volumes:
       - postgres_data:/var/lib/postgresql/data
       - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql
@@ -635,14 +635,16 @@ services:
   redis:
     image: redis:8-alpine
     container_name: redis
-    command: redis-server --appendonly yes --requirepass redispass
+    command: ["sh", "-c", "redis-server --appendonly yes --requirepass \"$$REDIS_PASSWORD\""]
+    environment:
+      REDIS_PASSWORD: ${REDIS_PASSWORD:?set REDIS_PASSWORD}
     volumes:
       - redis_data:/data
     networks:
       - backend-network
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
+      test: ["CMD-SHELL", "redis-cli -a \"$$REDIS_PASSWORD\" ping | grep -q PONG"]
       interval: 10s
       timeout: 5s
       retries: 5