# HTTP security headers on bex-api + dashboard SSR

Add a response-header middleware setting the standard hardening headers on bex-api (`lego/backend/internal/api/server.go` / the raw `http.Server` in `cmd/api/main.go:370-379`, no header middleware today) and on the dashboard SSR responses:

- `X-Content-Type-Options: nosniff`
- `X-Frame-Options: DENY` (bex-api is not meant to be framed)
- `Strict-Transport-Security` (HSTS) — behind TLS/prod only
- a conservative default `Content-Security-Policy` (tune for the dashboard's own assets)

Sub-hour. LOW value/severity — bex-api is primarily SDK/agent-facing (headers are mostly browser protections), and the dashboard is the real browser surface; do the dashboard side with the same care as any CSP change (don't break its asset loading). Health/webhook exemptions from the rate limiter are unrelated — this is orthogonal, every response gets the headers.

Not a milestone: too small (one middleware + a dashboard equivalent), no multi-task decomposition.

Source: `/pm-brainstorm for w7`, 2026-07-12 (security sweep finding #6).
