diff --git a/nuxt.config.ts b/nuxt.config.ts
index ab4694e..b43b6fa 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -63,6 +63,13 @@ export default defineNuxtConfig({
   },
 
   routeRules: {
+    "/api/**": {
+      headers: {
+        "X-Content-Type-Options": "nosniff",
+        "Referrer-Policy": "strict-origin-when-cross-origin",
+        "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
+      },
+    },
     "/**": {
       headers: {
         "X-Content-Type-Options": "nosniff",
@@ -76,7 +83,7 @@ export default defineNuxtConfig({
           "script-src 'self' 'unsafe-inline'; " +
           "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +
           "img-src 'self' data: blob: https://images.pexels.com https://www.pexels.com; " +
-          "connect-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com ws: wss:; " +
+          "connect-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://images.pexels.com ws: wss:; " +
           "font-src 'self' https://fonts.gstatic.com; " +
           "object-src 'none'; " +
           "base-uri 'self'; " +
diff --git a/server/api/get-image.ts b/server/api/get-image.ts
index 1daeab4..382675c 100644
--- a/server/api/get-image.ts
+++ b/server/api/get-image.ts
@@ -2,7 +2,14 @@ export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig();
   const { id } = getQuery(event);
 
-  // Walidacja: id musi być dodatnią liczbą całkowitą (zabezpieczenie przed SSRF)
+  if (!config.pexelsApiKey) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "Internal Server Error",
+      message: "Brak klucza API Pexels. Ustaw zmienną środowiskową PEXELS_API_KEY.",
+    });
+  }
+
   const photoId = Number(id);
   if (!id || !Number.isInteger(photoId) || photoId <= 0) {
     throw createError({
diff --git a/server/api/get-images.ts b/server/api/get-images.ts
index 4e4a7b4..17a46c0 100644
--- a/server/api/get-images.ts
+++ b/server/api/get-images.ts
@@ -4,7 +4,15 @@ export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig();
   const { per_page } = getQuery(event);
 
-  // Walidacja: per_page musi być liczbą całkowitą w zakresie 1–100
+  if (!config.pexelsApiKey) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "Internal Server Error",
+      message: "Brak klucza API Pexels. Ustaw zmienną środowiskową PEXELS_API_KEY.",
+    });
+  }
+
+  // ...existing code...
   const perPage = Number(per_page);
   if (!per_page || !Number.isInteger(perPage) || perPage < 1 || perPage > 100) {
     throw createError({