diff --git a/.gitignore b/.gitignore
index 60c6135..b621ed8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ src/frontend_vue/node_modules/
 src/frontend_vue/dist/
 dockerfiles/database/create.js
 *__pycache__/
+env.local
diff --git a/Makefile b/Makefile
index 801f95a..fa7ebe1 100644
--- a/Makefile
+++ b/Makefile
@@ -17,12 +17,9 @@ OUTPUT = "db"
 OUTDIR = "/tmp/three"  # if you're running this in docker, make sure to mount the volume
 DBADDR = "0.0.0.0:27017"  # don't use localhost
 
-MONGOEXPRESS_USER = mxuser
-MONGOEXPRESS_PASS = mxuserpassword
-DB_ADM_USER = valadmin
-DB_ADM_PASS = valadminpass
-DB_USR_USER = valuser
-DB_USR_PASS = valuserpass
+# credentials from .gitignored file
+# create it from env.default
+include env.local
 
 N_CORES = 1
 export
diff --git a/README.md b/README.md
index 7915c6e..427a374 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,11 @@ $ git submodule update
 
 ## Components
 
+### Credentials
+Copy `env.default` to `env.local` (gitignored).  
+Modify database credentials in `env.local`.  
+The file is used by `make`.  
+
 
 ### Database (2 containers)
 Set db admin, user, pass, etc in 'Makefile'.  
diff --git a/env.default b/env.default
new file mode 100644
index 0000000..acd119f
--- /dev/null
+++ b/env.default
@@ -0,0 +1,6 @@
+MONGOEXPRESS_USER = mxuser
+MONGOEXPRESS_PASS = mxuserpassword
+DB_ADM_USER = valadmin
+DB_ADM_PASS = valadminpass
+DB_USR_USER = valuser
+DB_USR_PASS = valuserpass
diff --git a/test_make/Makefile b/test_make/Makefile
new file mode 100644
index 0000000..e9ecfdf
--- /dev/null
+++ b/test_make/Makefile
@@ -0,0 +1,7 @@
+TEST_SECRET=default_secret
+
+include env
+export
+
+test:
+	@echo $(TEST_SECRET)
diff --git a/test_make/env b/test_make/env
new file mode 100644
index 0000000..f93c772
--- /dev/null
+++ b/test_make/env
@@ -0,0 +1 @@
+TEST_SECRET=secret123