diff --git a/.env b/.env
new file mode 100644
index 0000000..a34841f
--- /dev/null
+++ b/.env
@@ -0,0 +1,16 @@
+# ===== CSP 平台（测试账号）=====
+# 该文件会被仓库提交，仅用于开发/测试环境。
+
+# 前端默认填充的测试账号
+NEXT_PUBLIC_TEST_USERNAME=whoami139
+NEXT_PUBLIC_TEST_PASSWORD=whoami139
+
+# 后端启动时自动创建的管理员账号（如果不存在）
+CSP_SEED_ADMIN_USERNAME=admin
+CSP_SEED_ADMIN_PASSWORD=whoami139
+
+# 前端请求后端的地址（浏览器侧）
+NEXT_PUBLIC_API_BASE=http://localhost:8080
+
+# Next.js 服务端反代用（可选）
+BACKEND_INTERNAL_URL=http://backend:8080
diff --git a/backend/src/main.cc b/backend/src/main.cc
index 061671c..2c95044 100644
--- a/backend/src/main.cc
+++ b/backend/src/main.cc
@@ -1,7 +1,9 @@
 #include <drogon/drogon.h>
 
 #include "csp/app_state.h"
+#include "csp/services/auth_service.h"
 
+#include <cstdlib>
 #include <filesystem>
 
 int main(int argc, char** argv) {
@@ -11,6 +13,22 @@ int main(int argc, char** argv) {
 
   csp::AppState::Instance().Init(db_path);
 
+  // Optional seed admin user for dev/test.
+  {
+    const char* u = std::getenv("CSP_SEED_ADMIN_USERNAME");
+    const char* p = std::getenv("CSP_SEED_ADMIN_PASSWORD");
+    if (u && p && std::string(u).size() > 0 && std::string(p).size() > 0) {
+      try {
+        csp::services::AuthService auth(csp::AppState::Instance().db());
+        auth.Register(u, p);
+        LOG_INFO << "seed admin user created: " << u;
+      } catch (const std::exception& e) {
+        // Most likely UNIQUE constraint (already exists)
+        LOG_INFO << "seed admin user skipped: " << e.what();
+      }
+    }
+  }
+
   // CORS (dev-friendly). In production, prefer reverse proxy same-origin.
   drogon::app().registerPreRoutingAdvice([](const drogon::HttpRequestPtr& req,
                                            drogon::AdviceCallback&& cb,
diff --git a/docker-compose.yml b/docker-compose.yml
index b552163..20a67ad 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,7 @@
 services:
   backend:
+    env_file:
+      - .env
     build:
       context: .
       dockerfile: Dockerfile.backend
@@ -10,6 +12,8 @@ services:
     restart: unless-stopped
 
   frontend:
+    env_file:
+      - .env
     build:
       context: .
       dockerfile: Dockerfile.frontend
diff --git a/frontend/src/app/auth/page.tsx b/frontend/src/app/auth/page.tsx
index c120850..05eecc9 100644
--- a/frontend/src/app/auth/page.tsx
+++ b/frontend/src/app/auth/page.tsx
@@ -13,8 +13,12 @@ export default function AuthPage() {
   );
 
   const [mode, setMode] = useState<"register" | "login">("register");
-  const [username, setUsername] = useState("");
-  const [password, setPassword] = useState("");
+  const [username, setUsername] = useState(
+    process.env.NEXT_PUBLIC_TEST_USERNAME ?? ""
+  );
+  const [password, setPassword] = useState(
+    process.env.NEXT_PUBLIC_TEST_PASSWORD ?? ""
+  );
   const [loading, setLoading] = useState(false);
   const [resp, setResp] = useState<AuthResp | null>(null);