diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..83e98a2
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2025-02-12 - Missing Security Headers in Global Middleware
+**Vulnerability:** The API responses lacked basic security headers like Strict-Transport-Security (HSTS), X-Frame-Options, and X-Content-Type-Options.
+**Learning:** These headers are crucial for basic web application security, even for APIs, and should be added globally at the middleware layer. Overly restrictive CSP should be avoided for API services to maintain documentation availability.
+**Prevention:** Always include a foundational set of security headers for HTTP responses in FastAPI middleware during initial setup.
diff --git a/apps/api/src/cortex_api/middleware/request_context.py b/apps/api/src/cortex_api/middleware/request_context.py
index 06a56bd..2889e21 100644
--- a/apps/api/src/cortex_api/middleware/request_context.py
+++ b/apps/api/src/cortex_api/middleware/request_context.py
@@ -40,4 +40,10 @@ async def request_context_middleware(
         response.headers[X_REQUEST_ID_HEADER] = request_id
         if trace_context["trace_id"]:
             response.headers[X_TRACE_ID_HEADER] = str(trace_context["trace_id"])
+
+        # Add basic API security headers
+        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+
         return response