diff --git a/vercel.json b/vercel.json
index 72d37c2..841f31d 100644
--- a/vercel.json
+++ b/vercel.json
@@ -2,5 +2,40 @@
   "rewrites": [
     { "source": "/api/dropbox-proxy", "destination": "api/dropbox-proxy.js" },
     { "source": "/api/dropbox-sync", "destination": "api/dropbox-sync.js" }
+  ],
+  "headers": [
+    {
+      "source": "/(.*)",
+      "headers": [
+        {
+          "key": "X-Content-Type-Options",
+          "value": "nosniff"
+        },
+        {
+          "key": "X-Frame-Options",
+          "value": "DENY"
+        },
+        {
+          "key": "X-XSS-Protection",
+          "value": "1; mode=block"
+        },
+        {
+          "key": "Referrer-Policy",
+          "value": "strict-origin-when-cross-origin"
+        },
+        {
+          "key": "Permissions-Policy",
+          "value": "camera=(), microphone=(), geolocation=()"
+        },
+        {
+          "key": "Strict-Transport-Security",
+          "value": "max-age=63072000; includeSubDomains; preload"
+        },
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' https://hwithddwaapyhnfwcesj.supabase.co https://api.dropboxapi.com https://www.dropbox.com; font-src 'self'; frame-ancestors 'none';"
+        }
+      ]
+    }
   ]
 }