[FEAT] Secure Express API headers using helmet middleware

[mramansayyad]

Feature Request

The project uses Express but does not configure secure HTTP headers. Adding security middleware is a standard production-ready best practice to prevent common vulnerabilities (like Clickjacking, XSS, MIME sniffing, and Information Disclosure).

Proposed Solution

1. Install helmet as a dependency.
2. Register the middleware in the main server file:

   const helmet = require('helmet');
   app.use(helmet());

GSSoC '26

• Yes, I am participating in GirlScript Summer of Code and would like to build this.