diff --git a/api/routes.py b/api/routes.py
index aa3b68f..9f9d276 100644
--- a/api/routes.py
+++ b/api/routes.py
@@ -334,7 +334,15 @@ def handle_post(handler, parsed):
 # ── GET route helpers ─────────────────────────────────────────────────────────
 
 def _serve_static(handler, parsed):
-    static_file = Path(__file__).parent.parent / parsed.path.lstrip('/')
+    static_root = (Path(__file__).parent.parent / 'static').resolve()
+    # Strip the leading '/static/' prefix and resolve the full path
+    rel = parsed.path[len('/static/'):]
+    static_file = (static_root / rel).resolve()
+    # Sandbox check: resolved path must stay inside static_root
+    try:
+        static_file.relative_to(static_root)
+    except ValueError:
+        return j(handler, {'error': 'not found'}, status=404)
     if not static_file.exists() or not static_file.is_file():
         return j(handler, {'error': 'not found'}, status=404)
     ext = static_file.suffix.lower()
diff --git a/static/style.css b/static/style.css
index 642e97c..ee1d542 100644
--- a/static/style.css
+++ b/static/style.css
@@ -250,21 +250,21 @@
     .msg-body{padding-left:0;max-width:100%;}
     .msg-role{font-size:12px;}
     /* Composer */
-    .composer-wrap{padding:8px 10px 12px;}
+    .composer-wrap{padding:8px 10px 12px!important;}
     .composer-box{border-radius:12px;}
     .composer-box textarea{font-size:16px;min-height:40px;}
     .send-btn{padding:6px 14px;font-size:13px;}
     /* Empty state */
     .empty-state h2{font-size:18px;}
     .empty-state p{font-size:13px;}
-    .suggestion-grid{max-width:100%;}
+    .suggestion-grid{max-width:100%!important;}
     .suggestion-btn{font-size:12px;padding:8px 10px;}
     /* Approval card */
     .approval-card{padding:0 10px 8px;}
     .approval-btns{gap:6px;}
     .approval-btn{padding:5px 10px;font-size:11px;}
     /* Tool cards */
-    .tool-card{margin-left:0;font-size:12px;}
+    .tool-card{margin-left:0!important;font-size:12px;}
     /* Settings modal */
     .settings-panel{width:95vw;max-width:95vw;}
   }