diff --git a/backend/app/Middlewares/SecurityMiddleware.php b/backend/app/Middlewares/SecurityMiddleware.php
index e2728c2..abbae10 100644
--- a/backend/app/Middlewares/SecurityMiddleware.php
+++ b/backend/app/Middlewares/SecurityMiddleware.php
@@ -18,7 +18,7 @@ class SecurityMiddleware
         $response->setHeader('X-XSS-Protection', '1; mode=block'); // Prevent Cross-Site Scripting (XSS)
         $response->setHeader('X-Content-Type-Options', 'nosniff'); // Prevent MIME-sniffing
         $response->setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload'); // HSTS
-        $response->setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-eval' https://unpkg.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; object-src 'none';"); // CSP
+        $response->setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; object-src 'none';"); // CSP
 
         // 2. Input Sanitization to prevent XSS (Recursive)
         $body = $request->getBody();