# `ConduitMcp.Plugs.SecurityHeaders`
[🔗](https://github.com/nyo16/conduit_mcp/blob/v0.10.1/lib/conduit_mcp/plugs/security_headers.ex#L1)

Plug that adds standard security response headers to all responses.

Sets the following headers:
- `X-Content-Type-Options: nosniff` — prevents MIME-type sniffing
- `X-Frame-Options: DENY` — prevents clickjacking via iframes
- `Cache-Control: no-store` — prevents caching of API responses

`Strict-Transport-Security` is intentionally omitted because this library
may run behind a reverse proxy that handles TLS. Add it in your own plug
pipeline if needed.

---

*Consult [api-reference.md](api-reference.md) for complete listing*