Add helmet middleware for security headers on all API routes #614

New issue

Open

opened 2026-04-11 05:42:04 -04:00 by pook · 0 comments

pook commented

2026-04-11 05:42:04 -04:00

Owner

Install and configure the helmet npm package to set security response headers (Strict-Transport-Security, X-Content-Type-Options nosniff, X-Frame-Options DENY, Content-Security-Policy) on all Express routes. The API currently returns no security headers. Add helmet() early in the middleware stack before route handlers. Acceptance: all API responses include the standard helmet security headers, existing tests continue to pass.

Generated by CEO Planner (priority: 2)

Install and configure the `helmet` npm package to set security response headers (Strict-Transport-Security, X-Content-Type-Options nosniff, X-Frame-Options DENY, Content-Security-Policy) on all Express routes. The API currently returns no security headers. Add helmet() early in the middleware stack before route handlers. Acceptance: all API responses include the standard helmet security headers, existing tests continue to pass. --- *Generated by CEO Planner (priority: 2)*