diff --git a/.env.secrect.template b/.env.secrect.template
new file mode 100644
index 0000000..08601cd
--- /dev/null
+++ b/.env.secrect.template
@@ -0,0 +1,43 @@
+# ===========================================
+# NFOGuard Secrets Template
+# ===========================================
+# Copy this file to .env.secrets and add your actual credentials
+# This file contains sensitive data - do NOT commit to version control
+# Add .env.secrets to your .gitignore file
+
+# ===========================================
+# RADARR DATABASE PASSWORD (if using direct DB access)
+# ===========================================
+RADARR_DB_PASSWORD=your_postgres_password_here
+
+# Sonarr API key (found in Sonarr Settings > General > Security)
+SONARR_API_KEY=your_sonarr_api_key_here
+
+# ===========================================
+# EXTERNAL API KEYS (OPTIONAL - for metadata enhancement)
+# ===========================================
+# TMDB API key (for enhanced movie metadata)
+# Get from: https://www.themoviedb.org/settings/api
+TMDB_API_KEY=your_tmdb_api_key_here
+
+# TVDB API key (for enhanced TV metadata) 
+# Get from: https://thetvdb.com/api-information
+TVDB_API_KEY=your_tvdb_api_key_here
+
+# ===========================================
+# SECURITY NOTES
+# ===========================================
+# - This file should have restricted permissions (600)
+# - Never commit this file to version control
+# - Ensure .env.secrets is in your .gitignore
+# - Rotate API keys periodically for security
+# - Only provide keys for services you want to integrate with
+
+# ===========================================
+# SETUP INSTRUCTIONS
+# ===========================================
+# 1. Copy this file to .env.secrets
+# 2. Replace placeholder values with your actual credentials
+# 3. Set file permissions: chmod 600 .env.secrets
+# 4. Verify .env.secrets is in .gitignore
+# 5. Only fill in the keys for services you're using - others can be left empty