diff --git a/README.md b/README.md
index 956a1a0..189c8ee 100644
--- a/README.md
+++ b/README.md
@@ -60,12 +60,15 @@ novel-plus -- 父工程
 
 ## 前台 JWT 签名密钥
 
-启动 `novel-front` 前，通过 `JWT_SECRET` 提供 Base64 编码的随机密钥（至少 64 字节），不要将密钥提交到仓库：
+生产安装包的启动脚本会启用 `prod` 环境。解压 `novel-front.zip` 后，在启动前配置独立的 JWT 签名密钥：
 
 ```bash
-export JWT_SECRET="$(openssl rand -base64 64)"
+export JWT_SECRET="$(openssl rand -base64 64 | tr -d '\n')"
+bin/novel-front.sh start
 ```
 
+建议生成至少 64 字节的随机密钥，只生成一次并安全保存，在重启和同一部署的多个实例间复用。`prod` 环境未设置或仅设置空白 `JWT_SECRET` 时，会记录明确错误并终止应用启动。默认 `dev` 环境保留原有开发配置，无需额外设置；不要将开发环境用于生产。更换密钥会使原 token 失效。
+
 ## 项目截图
 
 ### 绿色主题模版
diff --git a/novel-front/src/main/java/com/java2nb/novel/core/config/JwtSecretValidator.java b/novel-front/src/main/java/com/java2nb/novel/core/config/JwtSecretValidator.java
new file mode 100644
index 0000000..90d3dc1
--- /dev/null
+++ b/novel-front/src/main/java/com/java2nb/novel/core/config/JwtSecretValidator.java
@@ -0,0 +1,27 @@
+package com.java2nb.novel.core.config;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.boot.ApplicationArguments;
+import org.springframework.boot.ApplicationRunner;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Component;
+
+/**
+ * Requires an explicitly configured JWT signing secret in production.
+ */
+@Component
+@Profile("prod")
+@Slf4j
+public class JwtSecretValidator implements ApplicationRunner {
+
+    @Override
+    public void run(ApplicationArguments args) {
+        String jwtSecret = System.getenv("JWT_SECRET");
+        if (jwtSecret == null || jwtSecret.isBlank()) {
+            log.error("JWT_SECRET environment variable is not configured. "
+                    + "Please configure it before starting the application. "
+                    + "Linux/macOS: export JWT_SECRET=\"$(openssl rand -base64 64 | tr -d '\\n')\"");
+            throw new IllegalStateException("Missing required environment variable: JWT_SECRET");
+        }
+    }
+}
diff --git a/novel-front/src/main/resources/application-dev.yml b/novel-front/src/main/resources/application-dev.yml
index 5eda262..742595a 100644
--- a/novel-front/src/main/resources/application-dev.yml
+++ b/novel-front/src/main/resources/application-dev.yml
@@ -2,6 +2,10 @@ spring:
   config:
     import: classpath:application-common-dev.yml
 
+jwt:
+  # Development only; production requires an explicit JWT_SECRET.
+  secret: ${JWT_SECRET:novel!#20191230}
+
 
 pic:
   save:
@@ -21,4 +25,4 @@ thread:
     #线程超时时间（秒）
     keep-alive-time: 10
     #队列大小
-    queue-size: 100
\ No newline at end of file
+    queue-size: 100
diff --git a/novel-front/src/main/resources/application.yml b/novel-front/src/main/resources/application.yml
index 873ccc0..14cd76f 100644
--- a/novel-front/src/main/resources/application.yml
+++ b/novel-front/src/main/resources/application.yml
@@ -7,7 +7,7 @@ spring:
     include: website,alipay,oss
 
 jwt:
-  secret: ${JWT_SECRET}
+  secret: ${JWT_SECRET:}
   expiration: 604800
 
 #缓存管理密码