diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6849804c..c0caea3e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,10 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Added
-- Library card actions can now provide per-song label and icon callbacks, so
-  plugins can render dynamic card badges without DOM patching.
-- **Core reader for source rigs (feedpak 1.18.0).** A pack can declare what a
+### Security
+
+- **Fixed stored XSS in the retune modal.** `retuneSong()` injected
+  `title`/`target`/`msg.filename`/`msg.error` into a modal's `innerHTML` via
+  unescaped template literals. `song.title` is attacker-influenceable
+  (imported GP/MusicXML/sloppak metadata) and reaches this sink directly
+  from the library card's "Convert to E Standard" menu action. Wrapped all
+  four values in the existing `esc()` helper, matching the escaping pattern
+  used everywhere else in the file.
+- **Hardened GP/arrangement XML parsing against entity-expansion ("billion
+  laughs") DoS** (#45). `xml.etree.ElementTree` has no built-in protection
+  against maliciously nested XML entities on untrusted input; a crafted
+  imported GP or arrangement XML file could exhaust memory/CPU on the
+  request thread. Added `lib/safe_xml.py`, a shared hardened-parse helper
+  using `defusedxml` (now a `requirements.txt` dependency, falling back to
+  stdlib with a logged warning if somehow absent), and switched every
+  untrusted-XML parse call site (`lib/gp2rs_gpx.py`, `lib/loosefolder.py`,
+  `lib/song.py`, `lib/routers/ws_highway.py`) to use it. Rejections are
+  normalised to `ET.ParseError` so existing `except ET.ParseError:` call
+  sites keep working unmodified.
+- **Capped decompressed size on sloppak zip extraction** (#46). Nothing
+  bounded a `.sloppak` zip's total decompressed size during extraction — a
+  highly-compressed malicious/corrupt pack could exhaust disk space (a "zip
+  bomb"), independent of the unpack-cache LRU eviction (which only bounds
+  the aggregate cache after the fact). `_unpack_zip()` now sums each
+  member's declared size against an 8 GB default cap (no decompression
+  needed to check it), aborting and cleaning up any partial extraction if
+  exceeded. Override with `FEEDBACK_SLOPPAK_MAX_UNPACK_MB` (`0` disables).
+- **Added baseline security headers to every response** (#47):
+  `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`,
+  `Referrer-Policy: strict-origin-when-cross-origin`, and a
+  `Content-Security-Policy` restricting `object-src`, `base-uri`, and
+  `frame-ancestors`, and requiring `'self'` or `https:` for
+  script/style/media/connect origins. `script-src`/`style-src` still permit
+  `'unsafe-inline'` — the v3 UI's own HTML uses `onclick="..."` attributes
+  throughout and inline `<script>`/`<style>` blocks, none of it nonce'd or
+  externalized today, so a stricter policy would need that rewritten first.
+  Defense-in-depth: this would have limited the blast radius of the retune
+  XSS above (and any future/residual one) even before that fix landed.
+
+### Added
+- Library card actions can now provide per-song label and icon callbacks, so
+  plugins can render dynamic card badges without DOM patching.
+- **Core reader for source rigs (feedpak 1.18.0).** A pack can declare what a
   MIDI part should sound like by binding a rig; core now reads that binding and
   hands it to the client instead of dropping it. Three parts: the
   `tone_changes` WS message carries the pack's rig bindings (`base_rig`, and
diff --git a/lib/gp2rs_gpx.py b/lib/gp2rs_gpx.py
index 9b46842c..be8d44ef 100644
--- a/lib/gp2rs_gpx.py
+++ b/lib/gp2rs_gpx.py
@@ -19,6 +19,7 @@
 from pathlib import Path
 
 from safepath import safe_join
+from safe_xml import safe_fromstring
 
 _log = logging.getLogger("feedBack.lib.gp2rs_gpx")
 
@@ -158,7 +159,7 @@ def _load_gpif(gp_path: str) -> ET.Element:
         with zipfile.ZipFile(_io.BytesIO(raw)) as zf:
             if 'Content/score.gpif' not in zf.namelist():
                 raise ValueError("Content/score.gpif not found in GP7/GP8 ZIP container")
-            return ET.fromstring(zf.read('Content/score.gpif'))
+            return safe_fromstring(zf.read('Content/score.gpif'))
 
     # GP6 (.gpx): BCFZ compressed or raw BCFS
     if raw[:4] == b'BCFZ':
@@ -173,7 +174,7 @@ def _load_gpif(gp_path: str) -> ET.Element:
     fs = _parse_bcfs(bcfs)
     if 'score.gpif' not in fs:
         raise ValueError("score.gpif not found in GPX container")
-    return ET.fromstring(fs['score.gpif'])
+    return safe_fromstring(fs['score.gpif'])
 
 
 # ---------------------------------------------------------------------------
diff --git a/lib/loosefolder.py b/lib/loosefolder.py
index 35fe6ba7..2ca59af1 100644
--- a/lib/loosefolder.py
+++ b/lib/loosefolder.py
@@ -23,9 +23,10 @@
 
 import json
 import math
-import xml.etree.ElementTree as ET
 from pathlib import Path
 
+from safe_xml import safe_parse
+
 AUDIO_NAMES = ["audio.wem", "song.wem"]
 # Match every extension server.get_song_art is prepared to serve
 # (jpeg/png/webp). Without `.jpeg`/`.webp`, loose folders shipping
@@ -109,7 +110,7 @@ def _named_audio_ok(name: str) -> bool:
         return False
     for xml in _iter_local_xmls(path):
         try:
-            root_tag = ET.parse(str(xml)).getroot().tag
+            root_tag = safe_parse(str(xml)).getroot().tag
         except Exception:
             continue
         if root_tag == "song":
@@ -178,7 +179,7 @@ def _arr_type_from_filename(stem: str) -> tuple:
 def _parse_xml_meta(xml_path: Path) -> dict:
     """Parse a chart arrangement XML and return song-level metadata."""
     try:
-        root = ET.parse(str(xml_path)).getroot()
+        root = safe_parse(str(xml_path)).getroot()
         if root.tag != "song":
             return {}
 
@@ -299,7 +300,7 @@ def _has_lyrics(path: Path) -> bool:
     """Return True if any XML in the folder is a vocals track."""
     for xml in _iter_local_xmls(path):
         try:
-            if ET.parse(str(xml)).getroot().tag == "vocals":
+            if safe_parse(str(xml)).getroot().tag == "vocals":
                 return True
         except Exception:
             pass
diff --git a/lib/routers/ws_highway.py b/lib/routers/ws_highway.py
index fd1ad602..3f843110 100644
--- a/lib/routers/ws_highway.py
+++ b/lib/routers/ws_highway.py
@@ -47,6 +47,7 @@
 import loosefolder as loosefolder_mod
 from metadata_db import _arr_smart_sort_key
 from dlc_paths import _get_dlc_dir, _resolve_dlc_path
+from safe_xml import safe_parse
 
 import appstate
 
@@ -745,7 +746,7 @@ def _evict_audio_cache():
         else:
             for xml_path in sorted(_xml_walk("*.xml")):
                 try:
-                    root = ET.parse(xml_path).getroot()
+                    root = safe_parse(xml_path).getroot()
                     if root.tag == "vocals":
                         # An empty <vocals/> shell would otherwise
                         # short-circuit later XML files, so only stop
@@ -911,7 +912,7 @@ def _xml_rank(xp):
             tone_base = ""  # <tonebase> of the preferred arrangement XML
             for xml_path in sorted_xml:
                 try:
-                    root = ET.parse(xml_path).getroot()
+                    root = safe_parse(xml_path).getroot()
                     if root.tag != "song":
                         continue
                     if _suppress_fallback and _xml_rank(xml_path) == 2:
diff --git a/lib/safe_xml.py b/lib/safe_xml.py
new file mode 100644
index 00000000..0e4303a8
--- /dev/null
+++ b/lib/safe_xml.py
@@ -0,0 +1,54 @@
+"""Hardened XML parsing shared by every GP/arrangement-XML import path
+(security audit, issue #45).
+
+``xml.etree.ElementTree`` has no built-in protection against
+entity-expansion ("billion laughs") DoS on untrusted input.
+``defusedxml`` hardens both ``parse()`` and ``fromstring()`` against it
+when installed. Centralised here so every call site that parses
+attacker-influenceable XML (imported Guitar Pro / arrangement files) uses
+the same guarded fallback, instead of each duplicating the inline
+try/except that lib/gp8_audio_sync.py and lib/gp_autosync.py used locally
+before this module existed.
+
+Attacks defusedxml rejects (``EntitiesForbidden``, ``DTDForbidden``, ...)
+are normalised to ``ET.ParseError`` so existing ``except ET.ParseError:``
+call sites keep working unmodified — a rejected malicious file should be
+treated the same as a malformed one, not crash the caller.
+"""
+import logging
+import xml.etree.ElementTree as ET
+
+log = logging.getLogger("feedBack.lib.safe_xml")
+
+try:
+    import defusedxml.ElementTree as _safe_ET
+    from defusedxml.common import DefusedXmlException as _DefusedXmlException
+    _HAVE_DEFUSEDXML = True
+except ImportError:
+    _safe_ET = None
+    _DefusedXmlException = ()
+    _HAVE_DEFUSEDXML = False
+    log.warning(
+        "safe_xml: defusedxml not installed; parsing untrusted XML with "
+        "stdlib xml.etree (install defusedxml for hardened parsing)"
+    )
+
+
+def safe_parse(source):
+    """Hardened equivalent of ``ET.parse(source)``."""
+    if not _HAVE_DEFUSEDXML:
+        return ET.parse(source)
+    try:
+        return _safe_ET.parse(source)
+    except _DefusedXmlException as e:
+        raise ET.ParseError(str(e)) from e
+
+
+def safe_fromstring(text):
+    """Hardened equivalent of ``ET.fromstring(text)``."""
+    if not _HAVE_DEFUSEDXML:
+        return ET.fromstring(text)
+    try:
+        return _safe_ET.fromstring(text)
+    except _DefusedXmlException as e:
+        raise ET.ParseError(str(e)) from e
diff --git a/lib/sloppak.py b/lib/sloppak.py
index b7c7791f..e35e6095 100644
--- a/lib/sloppak.py
+++ b/lib/sloppak.py
@@ -351,19 +351,53 @@ def _unpack_lock_for(filename: str) -> threading.Lock:
         return lk
 
 
+
+# Bounds a single zip's total DECOMPRESSED size during extraction — a highly
+# compressed malicious/corrupt .sloppak could otherwise exhaust disk space
+# (a "zip bomb") before anyone notices, independent of the unpack-cache
+# eviction above (which only bounds the aggregate cache after the fact, not
+# a single extraction in progress). Default 8 GB is generous for a real
+# multi-stem pack while still bounding the worst case. Override with
+# FEEDBACK_SLOPPAK_MAX_UNPACK_MB (0 disables the cap).
+def _unpack_max_bytes() -> int:
+    raw = os.environ.get("FEEDBACK_SLOPPAK_MAX_UNPACK_MB", "").strip()
+    try:
+        mb = int(raw) if raw else 8192
+    except ValueError:
+        mb = 8192
+    return max(0, mb) * 1024 * 1024
+
+
 def _unpack_zip(zip_path: Path, dest: Path) -> None:
     """Extract a sloppak zip archive into dest, replacing any previous contents.
 
     Members whose names escape ``dest`` via ``..`` segments, absolute paths, or
     Windows-style separators are skipped with a warning so a crafted sloppak
     can't write outside the unpack cache (zip-slip).
+
+    Raises ValueError if the archive's total declared decompressed size
+    exceeds the cap, aborting and cleaning up any partial extraction.
     """
     if dest.exists():
         shutil.rmtree(dest, ignore_errors=True)
     dest.mkdir(parents=True, exist_ok=True)
     dest_resolved = dest.resolve()
+    max_bytes = _unpack_max_bytes()
+    written = 0
     with zipfile.ZipFile(str(zip_path), "r") as zf:
         for member in zf.infolist():
+            # Declared size from the central directory — no decompression
+            # needed, so an oversized archive is caught before doing any
+            # real work on it.
+            if max_bytes and not member.is_dir():
+                written += member.file_size
+                if written > max_bytes:
+                    shutil.rmtree(dest, ignore_errors=True)
+                    raise ValueError(
+                        f"sloppak archive exceeds the {max_bytes} byte decompressed-size "
+                        f"cap (FEEDBACK_SLOPPAK_MAX_UNPACK_MB) — refusing to extract "
+                        f"what looks like a corrupt or malicious pack"
+                    )
             target = safe_join(dest_resolved, member.filename)
             if target is None:
                 log.warning("sloppak: rejected unsafe zip member %r", member.filename)
diff --git a/lib/song.py b/lib/song.py
index 3527d112..0f005f4a 100644
--- a/lib/song.py
+++ b/lib/song.py
@@ -8,6 +8,8 @@
 import math
 import xml.etree.ElementTree as ET
 
+from safe_xml import safe_parse
+
 log = logging.getLogger("feedBack.lib.song")
 
 
@@ -1118,7 +1120,7 @@ def _parse_note(n) -> Note:
 
 def parse_arrangement(xml_path: str) -> Arrangement:
     """Parse a chart arrangement XML file."""
-    tree = ET.parse(xml_path)
+    tree = safe_parse(xml_path)
     root = tree.getroot()
 
     # Name
@@ -1566,7 +1568,7 @@ def _mprop_int(key: str, props: dict) -> int:
     metadata_loaded = False
     for xml_path in xml_files:
         try:
-            tree = ET.parse(xml_path)
+            tree = safe_parse(xml_path)
             root = tree.getroot()
         except ET.ParseError:
             continue
diff --git a/requirements.txt b/requirements.txt
index c1f22788..82b63f56 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -29,3 +29,10 @@ requests>=2.31
 # Linux bundles, causing "backend failed before startup"). Declare it
 # explicitly, same as requests above.
 sniffio>=1.3.1
+
+# Hardened XML parsing for untrusted GP/arrangement imports (security audit,
+# issue #45) — guards xml.etree.ElementTree's entity-expansion ("billion
+# laughs") DoS. Used by lib/safe_xml.py, lib/gp8_audio_sync.py, and
+# lib/gp_autosync.py, all of which fall back to stdlib xml.etree with a
+# logged warning if this is somehow absent at runtime.
+defusedxml>=0.7.1
diff --git a/server.py b/server.py
index a1aa1d9c..a3ded5ce 100644
--- a/server.py
+++ b/server.py
@@ -102,6 +102,45 @@
 # opaque proxy-generated hex strings, not just RFC-4122 UUIDs.
 app.add_middleware(CorrelationIdMiddleware, validator=None)
 
+# Baseline security headers (security audit, issue #47) — defense-in-depth
+# against any future/residual XSS, clickjacking, and MIME-sniffing, applied
+# to every response. The CSP can't go stricter than 'unsafe-inline' for
+# script-src/style-src without a large rewrite: the v3 UI's own HTML uses
+# `onclick="..."` attributes throughout (static/v3/index.html), and inline
+# <script>/<style> blocks — none of that is nonce'd or externalized today.
+# script-src/style-src still restrict *which origins* may be loaded from to
+# 'self' plus https:, so an injected `<script src="http://evil...">` (or any
+# non-https origin) stays blocked; only inline execution remains open, same
+# as before this header existed. https: is intentionally broad rather than
+# an explicit CDN allowlist: plugins are user-installed and each may load
+# from a different CDN (see feedBack-plugin-piano/-staffview/-tabview),
+# which a fixed allowlist can't anticipate.
+_SECURITY_HEADERS = {
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY",
+    "Referrer-Policy": "strict-origin-when-cross-origin",
+    "Content-Security-Policy": (
+        "default-src 'self'; "
+        "script-src 'self' 'unsafe-inline' https:; "
+        "style-src 'self' 'unsafe-inline' https:; "
+        "img-src 'self' data: blob: https:; "
+        "font-src 'self' data: https:; "
+        "media-src 'self' blob: https:; "
+        "connect-src 'self' https: wss: ws:; "
+        "object-src 'none'; "
+        "base-uri 'self'; "
+        "frame-ancestors 'none'"
+    ),
+}
+
+
+@app.middleware("http")
+async def _security_headers(request: Request, call_next):
+    response = await call_next(request)
+    for header, value in _SECURITY_HEADERS.items():
+        response.headers.setdefault(header, value)
+    return response
+
 STATIC_DIR = Path(__file__).parent / "static"
 try:
     STATIC_DIR.mkdir(exist_ok=True)
diff --git a/static/app.js b/static/app.js
index 6aef021d..f4aea9bd 100644
--- a/static/app.js
+++ b/static/app.js
@@ -645,8 +645,8 @@ function retuneSong(filename, title, tuning, target) {
     modal.className = 'fixed inset-0 z-[200] flex items-center justify-center bg-black/70 backdrop-blur-sm';
     modal.innerHTML = `
         <div class="bg-dark-700 border border-gray-700 rounded-2xl p-8 w-full max-w-md mx-4 shadow-2xl">
-            <h3 class="text-lg font-bold text-white mb-1">Converting to ${target}</h3>
-            <p class="text-sm text-gray-400 mb-5">${title}</p>
+            <h3 class="text-lg font-bold text-white mb-1">Converting to ${esc(target)}</h3>
+            <p class="text-sm text-gray-400 mb-5">${esc(title)}</p>
             <div class="progress-bar mb-3"><div class="fill" id="retune-bar" style="width:0%"></div></div>
             <p class="text-xs text-gray-500" id="retune-stage">Connecting...</p>
         </div>`;
@@ -666,7 +666,7 @@ function retuneSong(filename, title, tuning, target) {
                 <div class="text-center">
                     <div class="text-3xl mb-3">✓</div>
                     <h3 class="text-lg font-bold text-white mb-1">Done!</h3>
-                    <p class="text-sm text-gray-400 mb-5">${msg.filename}</p>
+                    <p class="text-sm text-gray-400 mb-5">${esc(msg.filename)}</p>
                     <button onclick="document.getElementById('retune-modal').remove();loadLibrary()"
                         class="bg-accent hover:bg-accent-light px-6 py-2 rounded-xl text-sm font-semibold text-white transition">OK</button>
                 </div>`;
@@ -676,7 +676,7 @@ function retuneSong(filename, title, tuning, target) {
                 <div class="text-center">
                     <div class="text-3xl mb-3">✕</div>
                     <h3 class="text-lg font-bold text-red-400 mb-1">Failed</h3>
-                    <p class="text-sm text-gray-400 mb-5">${msg.error}</p>
+                    <p class="text-sm text-gray-400 mb-5">${esc(msg.error)}</p>
                     <button onclick="document.getElementById('retune-modal').remove()"
                         class="bg-dark-600 hover:bg-dark-500 px-6 py-2 rounded-xl text-sm text-gray-300 transition">Close</button>
                 </div>`;
diff --git a/tests/test_safe_xml.py b/tests/test_safe_xml.py
new file mode 100644
index 00000000..5784fc5a
--- /dev/null
+++ b/tests/test_safe_xml.py
@@ -0,0 +1,78 @@
+"""safe_xml hardens GP/arrangement XML parsing against entity-expansion
+("billion laughs") DoS on untrusted input (security audit, issue #45).
+
+xml.etree.ElementTree has no built-in protection against this; defusedxml
+does, when installed (it's a normal requirements.txt dependency now — see
+requirements.txt's comment on this). Both safe_parse()/safe_fromstring()
+must reject the classic billion-laughs payload, and normal XML must keep
+parsing exactly as before.
+"""
+
+import xml.etree.ElementTree as ET
+from pathlib import Path
+
+import pytest
+
+import safe_xml
+
+# The classic "billion laughs" payload: each entity expands to 10x the
+# previous, so `lol9` alone would expand to ~10^9 copies of "lol" if
+# entity expansion isn't blocked. Kept small enough (lol4) that even an
+# UNPROTECTED stdlib parse wouldn't hang the test suite — the assertion is
+# about REJECTION, not about surviving a full-size attack.
+BILLION_LAUGHS = """<?xml version="1.0"?>
+<!DOCTYPE lolz [
+ <!ENTITY lol "lol">
+ <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
+ <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
+ <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
+ <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
+]>
+<song>&lol4;</song>
+"""
+
+NORMAL_XML = '<song><arrangement>Lead</arrangement></song>'
+
+
+def test_defusedxml_is_actually_installed():
+    # The whole point of requirements.txt's addition — if this ever regresses
+    # (e.g. a requirements sync drops it), every other assertion in this file
+    # would silently start exercising the stdlib fallback instead of the
+    # hardened path, so pin it explicitly.
+    assert safe_xml._HAVE_DEFUSEDXML, (
+        "defusedxml not installed — safe_xml is silently running unhardened. "
+        "Check requirements.txt."
+    )
+
+
+def test_safe_fromstring_rejects_billion_laughs():
+    with pytest.raises(ET.ParseError):
+        safe_xml.safe_fromstring(BILLION_LAUGHS)
+
+
+def test_safe_parse_rejects_billion_laughs_from_a_file(tmp_path):
+    p = tmp_path / "bomb.xml"
+    p.write_text(BILLION_LAUGHS, encoding="utf-8")
+    with pytest.raises(ET.ParseError):
+        safe_xml.safe_parse(str(p))
+
+
+def test_safe_fromstring_still_parses_normal_xml():
+    root = safe_xml.safe_fromstring(NORMAL_XML)
+    assert root.tag == "song"
+    assert root.find("arrangement").text == "Lead"
+
+
+def test_safe_parse_still_parses_normal_xml_from_a_file(tmp_path):
+    p = tmp_path / "song.xml"
+    p.write_text(NORMAL_XML, encoding="utf-8")
+    root = safe_xml.safe_parse(str(p)).getroot()
+    assert root.tag == "song"
+
+
+def test_safe_fromstring_raises_parseerror_on_genuinely_malformed_xml():
+    # Ordinary malformed-XML behavior must be unchanged (still ET.ParseError,
+    # not some other exception type) so existing `except ET.ParseError:`
+    # call sites keep working for the mundane case too.
+    with pytest.raises(ET.ParseError):
+        safe_xml.safe_fromstring("<song><unclosed>")
diff --git a/tests/test_security_headers.py b/tests/test_security_headers.py
new file mode 100644
index 00000000..e75f7016
--- /dev/null
+++ b/tests/test_security_headers.py
@@ -0,0 +1,70 @@
+"""Baseline security headers on every response (security audit, issue #47).
+
+No prior test exercised response headers at all — server.py had zero
+defense-in-depth headers (X-Content-Type-Options, X-Frame-Options, CSP,
+...) before this fix. Fixture mirrors test_version_endpoint.py's pattern
+(fresh server import per test, background I/O suppressed).
+"""
+
+import importlib
+import sys
+
+import pytest
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture()
+def client(tmp_path, monkeypatch):
+    monkeypatch.setenv("CONFIG_DIR", str(tmp_path))
+    monkeypatch.setenv("FEEDBACK_SYNC_STARTUP", "1")
+    sys.modules.pop("server", None)
+    server = importlib.import_module("server")
+    monkeypatch.setattr(server, "load_plugins", lambda *a, **kw: None)
+    monkeypatch.setattr(server, "startup_scan", lambda: None)
+    with TestClient(server.app) as tc:
+        try:
+            yield tc
+        finally:
+            conn = getattr(getattr(server, "meta_db", None), "conn", None)
+            if conn is not None:
+                getattr(sys.modules.get("server"), "_join_background_db_threads", lambda: None)()
+                conn.close()
+
+
+def test_response_carries_baseline_security_headers(client):
+    r = client.get("/api/version")
+    assert r.status_code == 200
+    assert r.headers["X-Content-Type-Options"] == "nosniff"
+    assert r.headers["X-Frame-Options"] == "DENY"
+    assert r.headers["Referrer-Policy"] == "strict-origin-when-cross-origin"
+    assert "Content-Security-Policy" in r.headers
+
+
+def test_csp_restricts_default_and_object_src(client):
+    r = client.get("/api/version")
+    csp = r.headers["Content-Security-Policy"]
+    assert "default-src 'self'" in csp
+    assert "object-src 'none'" in csp
+    assert "frame-ancestors 'none'" in csp
+
+
+def test_csp_blocks_non_https_script_origins_but_allows_self_and_https(client):
+    r = client.get("/api/version")
+    csp = r.headers["Content-Security-Policy"]
+    script_src = next(part for part in csp.split(";") if part.strip().startswith("script-src"))
+    assert "'self'" in script_src
+    assert "https:" in script_src
+    # No bare http:, data:, or wildcard scheme — those are common XSS/CSP-
+    # bypass payload vectors this header exists to close off.
+    assert "http:" not in script_src
+    assert "data:" not in script_src
+    assert "*" not in script_src
+
+
+def test_security_headers_present_on_error_responses_too(client):
+    # A 404 (unknown route) must still carry the headers — they're set via
+    # middleware wrapping the whole call_next chain, not per-route.
+    r = client.get("/api/this-route-does-not-exist")
+    assert r.headers.get("X-Content-Type-Options") == "nosniff"
+    assert r.headers.get("X-Frame-Options") == "DENY"
+    assert "Content-Security-Policy" in r.headers
diff --git a/tests/test_sloppak_unpack_size_cap.py b/tests/test_sloppak_unpack_size_cap.py
new file mode 100644
index 00000000..93ef8e57
--- /dev/null
+++ b/tests/test_sloppak_unpack_size_cap.py
@@ -0,0 +1,95 @@
+"""_unpack_zip() bounds a single sloppak's total DECOMPRESSED size during
+extraction (security audit, issue #46) — independent of the unpack-cache
+LRU eviction in test_sloppak_unpack_cache.py, which only bounds the
+aggregate cache *after* an extraction finishes, not a single highly
+compressed/corrupt archive currently being extracted.
+
+The cap is checked against each zip member's *declared* size
+(``ZipInfo.file_size``, read from the central directory) before any bytes
+are decompressed, so a highly-compressed member with a huge declared size
+is rejected immediately rather than after writing megabytes/gigabytes to
+disk. Test members use real all-zero payloads (compress ~1000:1 with
+zlib) rather than forged ZipInfo metadata, matching the actual shape of a
+real zip bomb and keeping the test fast without needing to fake bytes on
+disk.
+"""
+
+import zipfile
+
+import pytest
+
+import sloppak as sloppak_mod
+
+
+def test_unpack_zip_rejects_when_declared_size_exceeds_cap(tmp_path, monkeypatch):
+    monkeypatch.setenv("FEEDBACK_SLOPPAK_MAX_UNPACK_MB", "1")  # 1 MB cap
+    zip_path = tmp_path / "bomb.sloppak"
+    with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_DEFLATED) as zf:
+        # 2 MB of zeros compresses to a few KB — declared (uncompressed)
+        # size honestly exceeds the 1 MB cap without a slow/large write.
+        zf.writestr("stems/audio.ogg", b"\x00" * (2 * 1024 * 1024))
+
+    dest = tmp_path / "unpacked"
+    with pytest.raises(ValueError, match="decompressed-size"):
+        sloppak_mod._unpack_zip(zip_path, dest)
+
+    assert not dest.exists(), "a rejected extraction must not leave a partial directory behind"
+
+
+def test_unpack_zip_allows_pack_under_the_cap(tmp_path, monkeypatch):
+    monkeypatch.setenv("FEEDBACK_SLOPPAK_MAX_UNPACK_MB", "1")  # 1 MB cap
+    zip_path = tmp_path / "small.sloppak"
+    with zipfile.ZipFile(zip_path, "w") as zf:
+        zf.writestr("manifest.yaml", "title: small\n")
+        zf.writestr("stems/audio.ogg", b"\x00" * 1024)  # 1 KB, well under the cap
+
+    dest = tmp_path / "unpacked"
+    sloppak_mod._unpack_zip(zip_path, dest)
+
+    assert (dest / "manifest.yaml").exists()
+    assert (dest / "stems" / "audio.ogg").read_bytes() == b"\x00" * 1024
+
+
+def test_unpack_zip_cap_disabled_via_zero(tmp_path, monkeypatch):
+    monkeypatch.setenv("FEEDBACK_SLOPPAK_MAX_UNPACK_MB", "0")
+    zip_path = tmp_path / "huge_declared.sloppak"
+    with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_DEFLATED) as zf:
+        # Declared size far above the (now-disabled) 1 MB cap must not raise.
+        zf.writestr("stems/audio.ogg", b"\x00" * (2 * 1024 * 1024))
+
+    dest = tmp_path / "unpacked"
+    sloppak_mod._unpack_zip(zip_path, dest)  # must not raise
+
+    assert dest.exists()
+
+
+def test_unpack_zip_default_cap_is_generous_for_a_real_pack(tmp_path, monkeypatch):
+    """No env var set — the built-in default (8 GB) must not reject an
+    ordinary small pack."""
+    monkeypatch.delenv("FEEDBACK_SLOPPAK_MAX_UNPACK_MB", raising=False)
+    zip_path = tmp_path / "normal.sloppak"
+    with zipfile.ZipFile(zip_path, "w") as zf:
+        zf.writestr("manifest.yaml", "title: normal\n")
+        zf.writestr("stems/audio.ogg", b"\x00" * 4096)
+
+    dest = tmp_path / "unpacked"
+    sloppak_mod._unpack_zip(zip_path, dest)  # must not raise
+
+    assert (dest / "manifest.yaml").exists()
+
+
+def test_unpack_zip_cap_sums_across_multiple_members(tmp_path, monkeypatch):
+    """Several members individually under the cap, but over it combined,
+    must still be rejected — the check is a running total, not per-file."""
+    monkeypatch.setenv("FEEDBACK_SLOPPAK_MAX_UNPACK_MB", "1")  # 1 MB cap
+    zip_path = tmp_path / "many_members.sloppak"
+    with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_DEFLATED) as zf:
+        for i in range(3):
+            # ~683 KB each declared, x3 ≈ 2 MB > 1 MB cap, each individually under it.
+            zf.writestr(f"stems/part{i}.ogg", b"\x00" * (700 * 1024))
+
+    dest = tmp_path / "unpacked"
+    with pytest.raises(ValueError, match="decompressed-size"):
+        sloppak_mod._unpack_zip(zip_path, dest)
+
+    assert not dest.exists()