[HIGH] Wire SecurityHeadersMiddleware into main.py — app missing CSP, HSTS, X-Frame-Options (Fixes #2892)

[namann5]

Description

The fully-implemented \SecurityHeadersMiddleware\ in \�ackend/security_middleware.py\ was never wired into the FastAPI application. This meant the app served all responses without:

• Content-Security-Policy (XSS mitigation)
• Strict-Transport-Security (HTTPS enforcement)
• X-Frame-Options: DENY (clickjacking prevention)
• X-Content-Type-Options: nosniff (MIME sniffing prevention)
• Referrer-Policy
• Permissions-Policy
• Cross-Origin-Opener-Policy

Changes

1. Added \rom backend.security_middleware import SecurityHeadersMiddleware\
2. Added \�pp.add_middleware(SecurityHeadersMiddleware)\ after \CSRFTokenMiddleware\
3. Removed duplicate \SUPABASE_URL\ / \SUPABASE_SERVICE_KEY\ environment variable reads

Closes #2892

[vercel]

@namann5 is attempting to deploy a commit to the ritesh Team on Vercel.

A member of the Team first needs to authorize it.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fdab4a91-442e-4677-a319-2efaf9a9e54e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}