diff --git a/.env.example b/.env.example
index e79187b..c0502d1 100644
--- a/.env.example
+++ b/.env.example
@@ -5,7 +5,8 @@
 APP_ENV=production
 PUBLIC_BASE_URL=https://zefix.silias.ch
 APP_SECRET=replace-with-output-of-openssl-rand-hex-32
-ZEFIX_PRIVATE_DIR=/var/lib/zefix-export
+# Leave empty to use ../zefix-private next to the project directory.
+ZEFIX_PRIVATE_DIR=
 
 # Cloudflare Turnstile
 TURNSTILE_SECRET=replace-with-turnstile-secret
diff --git a/README.md b/README.md
index 7a10db9..cc9ae49 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ Aktivierte Schutzschichten:
 | --- | --- |
 | `TURNSTILE_SECRET` | Geheimer Schlüssel des bestehenden Turnstile-Widgets für Siteverify |
 | `APP_SECRET` | Zufälliger geheimer Wert für Formulartoken und pseudonymisierte Rate-Limits |
-| `ZEFIX_PRIVATE_DIR` | Absoluter, dauerhaft beschreibbarer Pfad **ausserhalb** des Webroots |
+| `ZEFIX_PRIVATE_DIR` | Optionaler absoluter, dauerhaft beschreibbarer Pfad **ausserhalb** des Webroots; ohne Wert wird `../zefix-private` verwendet |
 | `username` | Benutzername der ZEFIX-API |
 | `password` | Passwort der ZEFIX-API |
 | `smtppassword` | Passwort des SMTP-Kontos |
@@ -39,7 +39,7 @@ Empfohlene Werte:
 ```text
 TURNSTILE_ALLOWED_HOSTNAME=zefix.silias.ch
 PUBLIC_BASE_URL=https://zefix.silias.ch
-ZEFIX_PRIVATE_DIR=/var/lib/zefix-export
+ZEFIX_PRIVATE_DIR=
 APP_SECRET=<mindestens 32 zufällige Bytes>
 ```
 
diff --git a/app.php b/app.php
index 8165069..1a0d860 100644
--- a/app.php
+++ b/app.php
@@ -8,8 +8,12 @@ declare(strict_types=1);
  * env_vars.php file is loaded when present so existing installations keep
  * working during migration.
  */
+$appFileEnvironment = [];
+
 function app_load_env_file(string $filename): void
 {
+    global $appFileEnvironment;
+
     if (!is_file($filename)) {
         return;
     }
@@ -57,8 +61,9 @@ function app_load_env_file(string $filename): void
             continue;
         }
 
-        // Real process variables and legacy configuration always take precedence.
-        if (getenv($name) !== false) {
+        // Non-empty process variables and legacy configuration take precedence.
+        $processValue = getenv($name);
+        if ($processValue !== false && trim((string)$processValue) !== '') {
             continue;
         }
 
@@ -78,7 +83,7 @@ function app_load_env_file(string $filename): void
             continue;
         }
 
-        putenv($name . '=' . $value);
+        $appFileEnvironment[$name] = $value;
         $_ENV[$name] = $value;
     }
 }
@@ -92,8 +97,18 @@ app_load_env_file(dirname(__DIR__) . DIRECTORY_SEPARATOR . '.env');
 
 function app_env(string $name, string $default = ''): string
 {
+    global $appFileEnvironment;
+
     $value = getenv($name);
-    return $value === false ? $default : trim((string)$value);
+    if ($value !== false && trim((string)$value) !== '') {
+        return trim((string)$value);
+    }
+
+    if (array_key_exists($name, $appFileEnvironment)) {
+        return trim((string)$appFileEnvironment[$name]);
+    }
+
+    return $default;
 }
 
 function app_env_int(string $name, int $default, int $min, int $max): int
diff --git a/gemeinden.php b/gemeinden.php
index abd5335..8ee9c3d 100644
--- a/gemeinden.php
+++ b/gemeinden.php
@@ -1,8 +1,13 @@
 
 <?php
-$communityCsv = app_cached_string(
-    'communities',
-    app_env_int('REFERENCE_CACHE_SECONDS', 86400, 300, 604800),
-    static fn(): string => communityCSV((string)$username, (string)$password)
-);
+$communityCsv = '';
+try {
+    $communityCsv = app_cached_string(
+        'communities',
+        app_env_int('REFERENCE_CACHE_SECONDS', 86400, 300, 604800),
+        static fn(): string => communityCSV((string)$username, (string)$password)
+    );
+} catch (Throwable $exception) {
+    error_log('Community reference data could not be loaded: ' . $exception->getMessage());
+}
 echo 'communityCsvData = ' . json_encode($communityCsv, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';';
diff --git a/legalForms.php b/legalForms.php
index 0e86d22..8571210 100644
--- a/legalForms.php
+++ b/legalForms.php
@@ -1,8 +1,13 @@
 
 <?php
-$legalFormsCsv = app_cached_string(
-    'legal-forms',
-    app_env_int('REFERENCE_CACHE_SECONDS', 86400, 300, 604800),
-    static fn(): string => legalFormCSV((string)$username, (string)$password)
-);
+$legalFormsCsv = '';
+try {
+    $legalFormsCsv = app_cached_string(
+        'legal-forms',
+        app_env_int('REFERENCE_CACHE_SECONDS', 86400, 300, 604800),
+        static fn(): string => legalFormCSV((string)$username, (string)$password)
+    );
+} catch (Throwable $exception) {
+    error_log('Legal-form reference data could not be loaded: ' . $exception->getMessage());
+}
 echo 'legalFormsCsvData = ' . json_encode($legalFormsCsv, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';';
diff --git a/zefixAPI.php b/zefixAPI.php
index 050e3d2..ec47b09 100644
--- a/zefixAPI.php
+++ b/zefixAPI.php
@@ -1,7 +1,7 @@
 <?php
 require_once __DIR__ . '/app.php';
-$username = getenv("username");
-$password = getenv("password");
+$username = app_env('username');
+$password = app_env('password');
 
 function sendAPICompanyInfoRequest(string $username, string $password, string $uid): string|bool {
 
@@ -118,6 +118,11 @@ function sendAPICommunityRequest(string $username, string $password): string|boo
 
 
 function communityCSV(string $username, string $password): string {
+    if ($username === '' || $password === '') {
+        error_log('ZEFIX credentials are not configured.');
+        return '';
+    }
+
     $response = sendAPICommunityRequest($username, $password);
     if (!is_string($response)) {
         return '';
@@ -131,6 +136,10 @@ function communityCSV(string $username, string $password): string {
     $csvOutput = "id,bfsId,Kanton,Gemeindename,registryOfCommerceId,replacedById\n";
 
     foreach ($communityArray as $item) {
+        if (!is_array($item)) {
+            return '';
+        }
+
         $row = [
             $item['id'] ?? '',
             $item['bfsId'] ?? '',
@@ -184,6 +193,11 @@ function sendAPILegalFormRequest(string $username, string $password): string|boo
 }
 
 function legalFormCSV(string $username, string $password): string {
+    if ($username === '' || $password === '') {
+        error_log('ZEFIX credentials are not configured.');
+        return '';
+    }
+
     $response = sendAPILegalFormRequest($username, $password);
     if (!is_string($response)) {
         return '';
@@ -196,6 +210,9 @@ function legalFormCSV(string $username, string $password): string {
     // Create CSV rows
 
     foreach ($legalformArray as $item) {
+        if (!is_array($item) || !isset($item['name']) || !is_array($item['name'])) {
+            return '';
+        }
         $csvOutput .= $item["id"].",".$item["name"]["de"] . "\n";
     }
     return $csvOutput;