implemented a lot of security measures

bootstrap/app.php

@@ -5,6 +5,7 @@ use App\Http\Middleware\EnsureTenantAdminToken;
 use App\Http\Middleware\EnsureTenantCollaboratorToken;
 use App\Http\Middleware\HandleAppearance;
 use App\Http\Middleware\HandleInertiaRequests;
+use App\Http\Middleware\ResponseSecurityHeaders;
 use App\Http\Middleware\SetLocaleFromUser;
 use App\Http\Middleware\TenantIsolation;
 use Illuminate\Foundation\Application;
@@ -68,13 +69,16 @@ return Application::configure(basePath: dirname(__DIR__))
             \App\Http\Middleware\SetLocale::class,
             SetLocaleFromUser::class,
             HandleAppearance::class,
+            ResponseSecurityHeaders::class,
             \App\Http\Middleware\ContentSecurityPolicy::class,
             HandleInertiaRequests::class,
             AddLinkHeadersForPreloadedAssets::class,
             \App\Http\Middleware\RequestTimingMiddleware::class,
         ]);
 
-        $middleware->api(append: []);
+        $middleware->api(append: [
+            ResponseSecurityHeaders::class,
+        ]);
     })
     ->withExceptions(function (Exceptions $exceptions) {
         //