diff --git a/modules/helpdesk/pages/helpdesk/ticket-file-data().php b/modules/helpdesk/pages/helpdesk/ticket-file-data().php
index 089cbbf..aa828bc 100644
--- a/modules/helpdesk/pages/helpdesk/ticket-file-data().php
+++ b/modules/helpdesk/pages/helpdesk/ticket-file-data().php
@@ -45,7 +45,18 @@ if (!$result['ok'] || !isset($result['data'])) {
 }
 
 $data = $result['data'];
+$maxFileSize = 20 * 1024 * 1024; // 20 MB
+
+if (strlen($data) > $maxFileSize) {
+    http_response_code(413);
+    Router::json(['ok' => false, 'error' => 'File too large']);
+
+    return;
+}
 
 $displayFilename = $filename !== '' ? $filename : 'attachment-' . $entryNo;
 
+header('X-Content-Type-Options: nosniff');
+header('Content-Security-Policy: sandbox');
+
 Router::download($displayFilename, $data);