Upload app.py

app.py

@@ -149,6 +149,27 @@ app.add_middleware(
 
 # ── Operational Guardrails Middleware ──────────────────────────────────────────
 
+@app.middleware("http")
+async def security_headers(request: Request, call_next):
+    """
+    Add security headers to every response.
+    X-Content-Type-Options — prevents MIME sniffing
+    X-Frame-Options        — prevents clickjacking
+    Referrer-Policy        — limits referrer leakage
+    X-XSS-Protection       — legacy XSS filter (belt-and-braces)
+    Permissions-Policy     — disables unused browser features
+    """
+    response = await call_next(request)
+    response.headers["X-Content-Type-Options"]  = "nosniff"
+    response.headers["X-Frame-Options"]          = "DENY"
+    response.headers["Referrer-Policy"]          = "strict-origin-when-cross-origin"
+    response.headers["X-XSS-Protection"]         = "1; mode=block"
+    response.headers["Permissions-Policy"]       = (
+        "geolocation=(), microphone=(), camera=(), payment=()"
+    )
+    return response
+
+
 @app.middleware("http")
 async def operational_guardrails(request: Request, call_next):
     settings = get_settings()