安全修复：1.密码哈希验证 2.移除硬编码凭据 3.JWT强密钥 4.CORS白名单

backend/db.js

@@ -1,11 +1,12 @@
 const { Pool } = require('pg');
+require('dotenv').config();
 
 const pool = new Pool({
-  host: 'localhost',
-  port: 5432,
-  database: 'company_finance',
-  user: 'postgres',
-  password: 'X123c321@',
+  host: process.env.DB_HOST || 'localhost',
+  port: parseInt(process.env.DB_PORT || '5432'),
+  database: process.env.DB_NAME || 'company_finance',
+  user: process.env.DB_USER || 'postgres',
+  password: process.env.DB_PASSWORD,
   max: 20,
   idleTimeoutMillis: 30000,
   connectionTimeoutMillis: 2000,