diff --git a/lib/Kalamar.pm b/lib/Kalamar.pm
index 61827f8..f5a111d 100644
--- a/lib/Kalamar.pm
+++ b/lib/Kalamar.pm
@@ -123,6 +123,22 @@
     );
   };
 
+  my $csp = $conf->{cs_policy} // (
+    "default-src 'self';".
+      "style-src 'self' 'unsafe-inline';".
+      "frame-src *;".
+      "media-src 'none';".
+      "object-src 'self';".
+      "font-src 'self';".
+      "img-src 'self' data:;"
+    );
+
+  $self->hook(
+    before_render => sub {
+      shift->res->headers->header('Content-Security-Policy' => $csp);
+    }
+  );
+
   # API is not yet set - define
   $conf->{api_path} //= $ENV{KALAMAR_API};
   $conf->{api_version} //= $API_VERSION;