diff --git a/app/main.py b/app/main.py
index f7203bf..c59782d 100644
--- a/app/main.py
+++ b/app/main.py
@@ -12,6 +12,7 @@ from starlette.middleware.sessions import SessionMiddleware
 from app.config import settings
 from app.db import init_db
 from app.middleware.csrf import CSRFMiddleware
+from app.middleware.security import ContentSecurityPolicyMiddleware, RateLimitMiddleware
 from app.routers import dashboard, board, notes, api, auth, webhooks, collections, my_tasks, workspace, public_api, admin
 from app.routers.gitea import router as gitea_router
 from app.services.gitea_client import gitea
@@ -48,6 +49,8 @@ app = FastAPI(
 
 app.add_middleware(SessionMiddleware, secret_key=settings.app_secret_key, max_age=3600)
 app.add_middleware(CSRFMiddleware)
+app.add_middleware(ContentSecurityPolicyMiddleware)
+app.add_middleware(RateLimitMiddleware)
 app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_methods=["*"], allow_headers=["*"])
 
 app.include_router(auth.router)