diff --git a/.env.example b/.env.example
index 7a0a790..bf0b7af 100644
--- a/.env.example
+++ b/.env.example
@@ -21,3 +21,10 @@ NEXT_PUBLIC_TRIAL_DAYS=7
 # Pricing (in cents for precision)
 NEXT_PUBLIC_MIN_PRICE=9900
 NEXT_PUBLIC_CURRENCY=₽
+
+# Database Configuration (for referral system)
+# Leave empty to disable referral DB tracking (dev mode)
+DB_HOST=193.168.175.128
+DB_USER=marzban_user
+DB_PASSWORD=2CuopqFd0Y5V5n/qBM+eygOQb6aC8B8pACcdHjeVJsE=
+DB_NAME=marzban_prod
diff --git a/app/api/referral/stats/route.ts b/app/api/referral/stats/route.ts
index 69fa321..3435401 100644
--- a/app/api/referral/stats/route.ts
+++ b/app/api/referral/stats/route.ts
@@ -4,14 +4,17 @@
 import { NextRequest, NextResponse } from 'next/server';
 import mysql from 'mysql2/promise';
 
-// Database connection config
+// Database connection config from ENV
 const dbConfig = {
-  host: '193.168.175.128',
-  user: 'marzban_user',
-  password: '2CuopqFd0Y5V5n/qBM+eygOQb6aC8B8pACcdHjeVJsE=',
-  database: 'marzban_prod',
+  host: process.env.DB_HOST || '',
+  user: process.env.DB_USER || '',
+  password: process.env.DB_PASSWORD || '',
+  database: process.env.DB_NAME || '',
 };
 
+// Check if DB is configured
+const isDbConfigured = dbConfig.host && dbConfig.user && dbConfig.database;
+
 export async function GET(request: NextRequest) {
   try {
     const { searchParams } = new URL(request.url);
@@ -24,6 +27,21 @@ export async function GET(request: NextRequest) {
       );
     }
 
+    // Return mock data if DB not configured (dev mode)
+    if (!isDbConfigured) {
+      console.log('⚠️ Referral stats skipped: DB not configured');
+      return NextResponse.json({
+        success: true,
+        hasReferrals: false,
+        dev_mode: true,
+        stats: {
+          referral_count: 0,
+          bonus_days_earned: 0,
+          total_referrals_used: 0,
+        },
+      });
+    }
+
     // Connect to database
     const connection = await mysql.createConnection(dbConfig);
 
diff --git a/app/api/referral/track/route.ts b/app/api/referral/track/route.ts
index 02030af..229c721 100644
--- a/app/api/referral/track/route.ts
+++ b/app/api/referral/track/route.ts
@@ -4,14 +4,17 @@
 import { NextRequest, NextResponse } from 'next/server';
 import mysql from 'mysql2/promise';
 
-// Database connection config
+// Database connection config from ENV
 const dbConfig = {
-  host: '193.168.175.128',
-  user: 'marzban_user',
-  password: '2CuopqFd0Y5V5n/qBM+eygOQb6aC8B8pACcdHjeVJsE=',
-  database: 'marzban_prod',
+  host: process.env.DB_HOST || '',
+  user: process.env.DB_USER || '',
+  password: process.env.DB_PASSWORD || '',
+  database: process.env.DB_NAME || '',
 };
 
+// Check if DB is configured
+const isDbConfigured = dbConfig.host && dbConfig.user && dbConfig.database;
+
 export async function POST(request: NextRequest) {
   try {
     const body = await request.json();
@@ -24,6 +27,16 @@ export async function POST(request: NextRequest) {
       );
     }
 
+    // Return mock success if DB not configured (dev mode)
+    if (!isDbConfigured) {
+      console.log('⚠️ Referral tracking skipped: DB not configured');
+      return NextResponse.json({
+        success: true,
+        message: 'Referral tracking disabled (dev mode)',
+        dev_mode: true,
+      });
+    }
+
     // Connect to database
     const connection = await mysql.createConnection(dbConfig);