diff --git a/cmd/picoclaw-launcher/internal/server/server.go b/cmd/picoclaw-launcher/internal/server/server.go
index 2c656d79a..2f1f29665 100644
--- a/cmd/picoclaw-launcher/internal/server/server.go
+++ b/cmd/picoclaw-launcher/internal/server/server.go
@@ -197,3 +197,13 @@ func RegisterAuthAPI(mux *http.ServeMux, absPath string) {
 	// GET /auth/callback — OAuth browser callback for Google Antigravity
 	mux.HandleFunc("GET /auth/callback", handleOAuthCallback)
 }
+
+// SecurityHeaders wraps an http.Handler to add standard security headers.
+func SecurityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'")
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/cmd/picoclaw-launcher/main.go b/cmd/picoclaw-launcher/main.go
index 3323c31a8..3774ebe7d 100644
--- a/cmd/picoclaw-launcher/main.go
+++ b/cmd/picoclaw-launcher/main.go
@@ -105,7 +105,7 @@ func main() {
 		}
 	}()
 
-	if err := http.ListenAndServe(addr, mux); err != nil {
+	if err := http.ListenAndServe(addr, server.SecurityHeaders(mux)); err != nil {
 		log.Fatalf("Server failed: %v", err)
 	}
 }