security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy

backend/server.js

@@ -69,6 +69,12 @@ app.use(express.urlencoded({ extended: true, limit: '1mb' }));
 app.use(sanitizeBody);
 app.use(generalLimiter);
 app.use('/api', apiKeyGuard);
+app.use('/api', (req, res, next) => {
+  res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, private');
+  res.setHeader('Pragma', 'no-cache');
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+  next();
+});
 
 const staticOpts = {
   maxAge: 0,