Function securityHeaders

internal/httpapi/middleware.go:142–147

securityHeaders applies the baseline security headers the audit found missing (api-v1-redesign "HTTP header conventions"). It deliberately sets only the universally-safe `X-Content-Type-Options: nosniff` at this layer; HSTS is an edge (Caddy) concern and the stricter CSP/frame headers belong on the

(next http.Handler)

// on the HTML confirmation pages, which set their own. Applying nosniff
// globally is additive and never breaks a JSON or HTML response.
func securityHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("X-Content-Type-Options", "nosniff")
		next.ServeHTTP(w, r)
	})
}