diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 000000000..65add249b
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-08-05 - Add `ReadHeaderTimeout` to `http.Server` to prevent Slowloris Attacks (CWE-400)
+**Vulnerability:** Found `http.Server` instances in `internal/mcp/oauth.go`, `internal/oauth/loopback.go`, and `internal/provideroauth/openrouter.go` lacking `ReadHeaderTimeout` configuration.
+**Learning:** This is a common pattern flagged by gosec as G112 (CWE-400) where an HTTP server is vulnerable to Slowloris attacks because it lacks timeouts for reading request headers, which can lead to resource exhaustion.
+**Prevention:** Always configure `ReadHeaderTimeout` when initializing `http.Server` in Go.
diff --git a/internal/mcp/oauth.go b/internal/mcp/oauth.go
index 678d58045..e402e5e6a 100644
--- a/internal/mcp/oauth.go
+++ b/internal/mcp/oauth.go
@@ -409,6 +409,7 @@ func Login(ctx context.Context, options LoginOptions) (StoredToken, error) {
 	}
 	resultChan := make(chan callbackResult, 1)
 	server := &http.Server{
+		ReadHeaderTimeout: 10 * time.Second,
 		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			if r.URL.Path != "/callback" {
 				http.NotFound(w, r)
diff --git a/internal/oauth/loopback.go b/internal/oauth/loopback.go
index 6b29e0f27..463e5d5be 100644
--- a/internal/oauth/loopback.go
+++ b/internal/oauth/loopback.go
@@ -50,7 +50,10 @@ func NewLoopbackListenerOnPort(state string, port int) (*LoopbackListener, error
 		state:    state,
 		result:   make(chan callbackResult, 1),
 	}
-	l.server = &http.Server{Handler: http.HandlerFunc(l.handle)}
+	l.server = &http.Server{
+		ReadHeaderTimeout: 10 * time.Second,
+		Handler:           http.HandlerFunc(l.handle),
+	}
 	go func() { _ = l.server.Serve(ln) }()
 	return l, nil
 }
diff --git a/internal/provideroauth/openrouter.go b/internal/provideroauth/openrouter.go
index 8a99b3148..143d010a4 100644
--- a/internal/provideroauth/openrouter.go
+++ b/internal/provideroauth/openrouter.go
@@ -79,26 +79,29 @@ func OpenRouterLogin(ctx context.Context, opts OpenRouterOptions) (string, error
 
 	codeCh := make(chan string, 1)
 	errCh := make(chan error, 1)
-	server := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/callback" {
-			http.NotFound(w, r)
-			return
-		}
-		if code := strings.TrimSpace(r.URL.Query().Get("code")); code != "" {
-			_, _ = io.WriteString(w, "OpenRouter authorization complete. You may close this window.")
+	server := &http.Server{
+		ReadHeaderTimeout: 10 * time.Second,
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path != "/callback" {
+				http.NotFound(w, r)
+				return
+			}
+			if code := strings.TrimSpace(r.URL.Query().Get("code")); code != "" {
+				_, _ = io.WriteString(w, "OpenRouter authorization complete. You may close this window.")
+				select {
+				case codeCh <- code:
+				default:
+				}
+				return
+			}
+			w.WriteHeader(http.StatusBadRequest)
+			_, _ = io.WriteString(w, "Authorization failed. You may close this window.")
 			select {
-			case codeCh <- code:
+			case errCh <- errors.New("provideroauth: callback missing authorization code"):
 			default:
 			}
-			return
-		}
-		w.WriteHeader(http.StatusBadRequest)
-		_, _ = io.WriteString(w, "Authorization failed. You may close this window.")
-		select {
-		case errCh <- errors.New("provideroauth: callback missing authorization code"):
-		default:
-		}
-	})}
+		}),
+	}
 	go func() { _ = server.Serve(listener) }()
 	defer func() {
 		shutdownCtx, cancelShutdown := context.WithTimeout(context.Background(), time.Second)