diff --git a/apps/api-server/internal/middleware/performance.go b/apps/api-server/internal/middleware/performance.go
index 369563c..c6d3b5c 100644
--- a/apps/api-server/internal/middleware/performance.go
+++ b/apps/api-server/internal/middleware/performance.go
@@ -260,6 +260,9 @@ func SecurityHeadersMiddleware() gin.HandlerFunc {
 		c.Header("X-Frame-Options", "DENY")
 		c.Header("X-XSS-Protection", "1; mode=block")
 		c.Header("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+		c.Header("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'")
+		c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
+		c.Header("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
 		c.Next()
 	}
 }