diff --git a/.env.example b/.env.example
index dd80d406..9b30f0fb 100644
--- a/.env.example
+++ b/.env.example
@@ -45,5 +45,5 @@ NODE_ENV=production
 
 # LogStorm attendance analyzer
 LOGSTORM_API_URL=http://localhost:8000
-LOGSTORM_API_TOKEN=change-me
+LOGSTORM_API_TOKEN=change-me-logstorm-token
 LOGSTORM_TIMEOUT_SECONDS=30
diff --git a/.gitignore b/.gitignore
index 929c718b..c63b7a38 100644
--- a/.gitignore
+++ b/.gitignore
@@ -107,8 +107,9 @@ celerybeat.pid
 *.sage.py
 
 # Environments
-.env
-backend/.env.domen
+.env*
+!.env.example
+!**/.env.example
 .venv
 .kali
 env/
@@ -155,6 +156,8 @@ dmypy.json
 # Медиа файлы (загруженные пользователями)
 # Игнорируем все файлы в media/, но сохраняем структуру папок через .gitkeep
 */media/*
+media/
+uploads/
 
 # Устаревшие пути (deprecated)
 smedia/
@@ -183,10 +186,23 @@ ooo.html
 # Archive files (should not be in git)
 *.zip
 *.tar.gz
+*.tgz
 *.rar
+*.7z
+
+# Certificates and private keys
+*.pem
+*.key
+*.crt
+*.cer
+*.csr
+*.p12
+*.pfx
 
 # Test reports
 newman-report*.json
 *-report.json
 dump.rdb
 .playwright-cli/
+.ruff_cache/
+.pytest_cache/
diff --git a/README.md b/README.md
new file mode 100644
index 00000000..8d7eaeb4
--- /dev/null
+++ b/README.md
@@ -0,0 +1,84 @@
+# EUSRR
+
+EUSRR is an internal enterprise service portal built with Django, Django REST Framework, Next.js, PostgreSQL, Redis, Celery, WebSockets, LDAP integration, notifications, document workflows, procurement workflows, scheduling, and employee self-service modules.
+
+The project demonstrates full-stack product development: backend architecture, REST APIs, role-based access, asynchronous tasks, realtime updates, frontend application structure, testing, deployment-oriented configuration, and production-style operational documentation.
+
+## Core Modules
+
+- Employee directory, profiles, departments, roles, and LDAP synchronization.
+- Requests and approval workflows with status tracking and notifications.
+- Procurement flows, approval routes, item handling, and delivery state tracking.
+- Documents, files, comments, and internal collaboration features.
+- Calendar and scheduling features with shared events.
+- Realtime communications, WebSocket notifications, and chat-oriented workflows.
+- LogStorm attendance integration for operational analytics.
+
+## Tech Stack
+
+- Backend: Python, Django, Django REST Framework, Channels, Celery, Redis, PostgreSQL.
+- Frontend: Next.js, React, TypeScript, Tailwind CSS, Recharts, React Table.
+- Integrations: LDAP, Web Push, Telegram/Synology-style notification adapters, LogStorm API.
+- Testing: pytest for backend tests, Node test runner and ESLint for frontend checks.
+- Deployment: Docker-oriented settings, environment-based configuration, Nginx-ready service layout.
+
+## Repository Layout
+
+```text
+backend/   Django backend, APIs, Celery tasks, migrations, tests, docs
+frontend/  Next.js frontend application
+docs/      Architecture notes, implementation reports, guides, diagnostics
+```
+
+## Local Setup
+
+Backend:
+
+```bash
+cd backend
+python -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt
+cp ../.env.example ../.env
+python manage.py migrate
+python manage.py runserver
+```
+
+Frontend:
+
+```bash
+cd frontend
+npm install
+cp .env.example .env.local
+npm run dev
+```
+
+Open the frontend at `http://localhost:3000` and configure `NEXT_PUBLIC_BACKEND_URL` to point to the backend.
+
+## Tests
+
+Backend:
+
+```bash
+cd backend
+pytest
+```
+
+Frontend:
+
+```bash
+cd frontend
+npm test
+npm run lint
+npm run build
+```
+
+## Security Notes
+
+This public version is prepared as a portfolio snapshot. Environment files, local databases, media uploads, certificates, private keys, generated builds, and deployment-specific artifacts are excluded from version control.
+
+All credentials must be supplied through environment variables. Example files contain placeholders only and must not be used as production secrets.
+
+## Demo Data
+
+The repository does not include production data. Any company-specific values should be replaced with local demo data before running the project outside its original environment.
diff --git a/backend/employees/ldap/tests/conftest.py b/backend/employees/ldap/tests/conftest.py
index aa5eebf1..b2f0b8ef 100644
--- a/backend/employees/ldap/tests/conftest.py
+++ b/backend/employees/ldap/tests/conftest.py
@@ -2,6 +2,8 @@
 Pytest конфигурация и фикстуры для тестирования LDAP модуля.
 """
 
+import os
+
 import pytest
 from unittest.mock import Mock, patch
 from django.contrib.auth.models import Group as DjangoGroup
@@ -271,7 +273,10 @@ def ldap_test_settings(settings):
     settings.LDAP_HOST = 'ldaps://test.example.com:636'
     settings.LDAP_BASE_DN = 'DC=example,DC=com'
     settings.LDAP_BIND_DN = 'CN=TestUser,DC=example,DC=com'
-    settings.LDAP_BIND_PASSWORD = 'test_password'
+    settings.LDAP_BIND_PASSWORD = os.getenv(
+        'LDAP_BIND_PASSWORD',
+        'test-ldap-bind-password',
+    )
     settings.LDAP_GROUPS_BASE = 'OU=Groups,DC=example,DC=com'
     settings.LDAP_POSITIONS_BASE = 'OU=Positions,DC=example,DC=com'
     settings.LDAP_UPN_SUFFIX = '@example.com'
diff --git a/backend/scripts/diagnostic/check_ldap_user.py b/backend/scripts/diagnostic/check_ldap_user.py
index ebdda65f..c820bf72 100644
--- a/backend/scripts/diagnostic/check_ldap_user.py
+++ b/backend/scripts/diagnostic/check_ldap_user.py
@@ -3,21 +3,26 @@
 Скрипт для проверки записи пользователя в LDAP
 """
 import sys
+import os
 from ldap3 import Server, Connection, ALL, SUBTREE, Tls
 import ssl
 
-# Данные для подключения из .env (закомментированные строки)
-LDAP_URI = "ldaps://DCII.robotail.local:636"
-LDAP_BIND_DN = "corp@robotail.local"
-LDAP_BIND_PASSWORD = "change-me-redacted-secret"
-LDAP_BASE_DN = "DC=robotail,DC=local"
-LDAP_USERS_BASE = "OU=Users,OU=company,DC=robotail,DC=local"
-LDAP_CA_CERT = "C:\\ca\\corp-ca.pem"
+# Connection settings are read from environment variables.
+LDAP_URI = os.getenv("LDAP_SERVER_URI", "ldaps://ldap.example.local:636")
+LDAP_BIND_DN = os.getenv("LDAP_BIND_DN", "user@example.local")
+LDAP_BIND_PASSWORD = os.getenv("LDAP_BIND_PASSWORD", "")
+LDAP_BASE_DN = os.getenv("LDAP_BASE_DN", "DC=example,DC=local")
+LDAP_USERS_BASE = os.getenv("LDAP_USERS_BASE", "OU=Users,DC=example,DC=local")
+LDAP_CA_CERT = os.getenv("LDAP_CA_CERT", "corp-ca.pem")
 
 # Email пользователя для поиска
 USER_EMAIL = "nadein-igor-vladimirovich@05-04-1999.ru"
 
 def main():
+    if not LDAP_BIND_PASSWORD:
+        print("LDAP_BIND_PASSWORD environment variable is required")
+        sys.exit(1)
+
     print(f"=" * 80)
     print(f"Подключение к LDAP: {LDAP_URI}")
     print(f"Bind DN: {LDAP_BIND_DN}")
diff --git a/frontend/.env.example b/frontend/.env.example
index 02105451..00753b85 100644
--- a/frontend/.env.example
+++ b/frontend/.env.example
@@ -1,12 +1,11 @@
-# Next.js Environment Variables Example
-# Copy this file to .env.local for local development
-# Copy this file to .env for production
+# Next.js environment variables example.
+# Copy this file to .env.local for local development and replace placeholders.
 
 # Backend API URL
-NEXT_PUBLIC_BACKEND_URL=http://localhost:9000
+NEXT_PUBLIC_BACKEND_URL=http://localhost:8000
 
 # API URL (optional, defaults to BACKEND_URL/api/v1)
-NEXT_PUBLIC_API_URL=http://localhost:9000/api/v1
+NEXT_PUBLIC_API_URL=http://localhost:8000/api/v1
 
-# WebSocket URL (БЕЗ пути /ws/, он добавляется автоматически в коде)
-NEXT_PUBLIC_WS_URL=ws://localhost:9000
+# WebSocket URL without the /ws/ path; the application adds it automatically.
+NEXT_PUBLIC_WS_URL=ws://localhost:8000