From c67eceee3b48a0f7504c8e45db5a592b370deaef Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 20:08:21 +0000
Subject: [PATCH] Add standard security headers in API middleware

Adds `Strict-Transport-Security`, `X-Frame-Options`, and `X-Content-Type-Options` headers to API responses in `request_context_middleware`.

Co-authored-by: crabcanon <3458947+crabcanon@users.noreply.github.com>
---
 .jules/sentinel.md                                    | 4 ++++
 apps/api/src/cortex_api/middleware/request_context.py | 6 ++++++
 2 files changed, 10 insertions(+)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..06470da
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-05-30 - Added security headers in API response middleware
+**Vulnerability:** Missing security headers in API responses, which can expose the application to clickjacking, MIME sniffing, and downgrade attacks.
+**Learning:** Security headers should be handled centrally in the request lifecycle middleware (`apps/api/src/cortex_api/middleware/request_context.py`) rather than per-endpoint.
+**Prevention:** Implement security headers in the global request context middleware to ensure all endpoints automatically inherit these protections.
diff --git a/apps/api/src/cortex_api/middleware/request_context.py b/apps/api/src/cortex_api/middleware/request_context.py
index 06a56bd..edebd50 100644
--- a/apps/api/src/cortex_api/middleware/request_context.py
+++ b/apps/api/src/cortex_api/middleware/request_context.py
@@ -40,4 +40,10 @@ async def request_context_middleware(
         response.headers[X_REQUEST_ID_HEADER] = request_id
         if trace_context["trace_id"]:
             response.headers[X_TRACE_ID_HEADER] = str(trace_context["trace_id"])
+
+        # Security headers
+        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+
         return response