From d6040379c283c2ac1a1d9056757a14cd03fe6b1c Mon Sep 17 00:00:00 2001
From: ht <hikmet@texmart.com>
Date: Sun, 6 Sep 2026 17:53:33 +0300
Subject: [PATCH] add API response security headers

---
 server/index.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/server/index.js b/server/index.js
index 8500ac6..94db1fd 100644
--- a/server/index.js
+++ b/server/index.js
@@ -608,6 +608,8 @@ function json(res, code, body) {
     'Content-Type': 'application/json; charset=utf-8',
     'Access-Control-Allow-Origin': '*',
     'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer',
   });
   res.end(JSON.stringify(body));
 }