From 811366b73e1d2e6f730f2c19d5105a06136ef4cd Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 20:04:30 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[security?=
 =?UTF-8?q?=20improvement]=20Add=20security=20headers=20to=20API=20respons?=
 =?UTF-8?q?es?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added `Strict-Transport-Security`, `X-Frame-Options`, and `X-Content-Type-Options` to `apps/api/src/cortex_api/middleware/request_context.py` to harden the API globally.

Co-authored-by: crabcanon <3458947+crabcanon@users.noreply.github.com>
---
 apps/api/src/cortex_api/middleware/request_context.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/apps/api/src/cortex_api/middleware/request_context.py b/apps/api/src/cortex_api/middleware/request_context.py
index 06a56bd..07b764c 100644
--- a/apps/api/src/cortex_api/middleware/request_context.py
+++ b/apps/api/src/cortex_api/middleware/request_context.py
@@ -40,4 +40,9 @@ async def request_context_middleware(
         response.headers[X_REQUEST_ID_HEADER] = request_id
         if trace_context["trace_id"]:
             response.headers[X_TRACE_ID_HEADER] = str(trace_context["trace_id"])
+
+        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+
         return response