diff --git a/.gitignore b/.gitignore
index f7ea1d3..f1b8e9a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,7 @@ public/assets/
 database/*.sqlite
 database/*.sqlite-shm
 database/*.sqlite-wal
+database/.provision.lock
 
 # ============================================
 # Cache & Logs
diff --git a/src/Shared/Bootstrap.php b/src/Shared/Bootstrap.php
index 974d347..e1f6029 100644
--- a/src/Shared/Bootstrap.php
+++ b/src/Shared/Bootstrap.php
@@ -11,6 +11,7 @@ use App\Shared\Extension\CsrfExtension;
 use App\Shared\Extension\SessionExtension;
 use DI\ContainerBuilder;
 use Dotenv\Dotenv;
+use Dotenv\Exception\InvalidPathException;
 use PDO;
 use Psr\Container\ContainerInterface;
 use Psr\Http\Message\ResponseInterface;
@@ -124,8 +125,22 @@ final class Bootstrap
 
     private function loadEnvironment(): void
     {
-        $dotenv = Dotenv::createImmutable(__DIR__.'/../..');
-        $dotenv->load();
+        $rootDir = dirname(__DIR__, 2);
+        $envPath = $rootDir . '/.env';
+
+        try {
+            $dotenv = Dotenv::createImmutable($rootDir);
+            $dotenv->load();
+        } catch (InvalidPathException $exception) {
+            throw new \RuntimeException(
+                sprintf(
+                    "Fichier .env introuvable a la racine du projet (%s). Copiez .env.example vers .env avant de demarrer l'application.",
+                    $envPath
+                ),
+                previous: $exception,
+            );
+        }
+
         $dotenv->required(['APP_URL', 'ADMIN_USERNAME', 'ADMIN_EMAIL', 'ADMIN_PASSWORD']);
 
         date_default_timezone_set($_ENV['TIMEZONE'] ?? 'UTC');
diff --git a/views/admin/posts/form.twig b/views/admin/posts/form.twig
index c902645..6d38003 100644
--- a/views/admin/posts/form.twig
+++ b/views/admin/posts/form.twig
@@ -128,9 +128,19 @@
             plugins: {
                 upload: {
                     serverPath: '/admin/media/upload',
-                    fileFieldName: 'file',
-                    urlPropertyName: 'url',
-                    statusPropertyName: 'success'
+                    fileFieldName: 'image',
+                    urlPropertyName: 'file',
+                    statusPropertyName: 'success',
+                    data: [
+                        {
+                            name: '{{ csrf.keys.name|e('js') }}',
+                            value: '{{ csrf.name|e('js') }}'
+                        },
+                        {
+                            name: '{{ csrf.keys.value|e('js') }}',
+                            value: '{{ csrf.value|e('js') }}'
+                        }
+                    ]
                 }
             }
         });