diff --git a/openhands/server/routes/security.py b/openhands/server/routes/security.py
index ef1721bafb182..4021db734524a 100644
--- a/openhands/server/routes/security.py
+++ b/openhands/server/routes/security.py
@@ -1,3 +1,4 @@
+from typing import Any
 from fastapi import (
     APIRouter,
     HTTPException,
@@ -8,7 +9,7 @@
 
 
 @app.route('/security/{path:path}', methods=['GET', 'POST', 'PUT', 'DELETE'])
-async def security_api(request: Request):
+async def security_api(request: Request) -> dict[str, Any]:
     """Catch-all route for security analyzer API requests.
 
     Each request is handled directly to the security analyzer.
@@ -17,7 +18,7 @@ async def security_api(request: Request):
         request (Request): The incoming FastAPI request object.
 
     Returns:
-        Any: The response from the security analyzer.
+        dict: The response from the security analyzer.
 
     Raises:
         HTTPException: If the security analyzer is not initialized.
@@ -25,6 +26,9 @@ async def security_api(request: Request):
     if not request.state.conversation.security_analyzer:
         raise HTTPException(status_code=404, detail='Security analyzer not initialized')
 
-    return await request.state.conversation.security_analyzer.handle_api_request(
+    response = await request.state.conversation.security_analyzer.handle_api_request(
         request
     )
+    if not isinstance(response, dict):
+        raise HTTPException(status_code=500, detail='Invalid response from security analyzer')
+    return response
diff --git a/openhands/server/static.py b/openhands/server/static.py
index ca7eb36c9b0a4..b1b8d853519b6 100644
--- a/openhands/server/static.py
+++ b/openhands/server/static.py
@@ -1,8 +1,10 @@
+from typing import Any, MutableMapping
 from fastapi.staticfiles import StaticFiles
+from starlette.responses import Response
 
 
 class SPAStaticFiles(StaticFiles):
-    async def get_response(self, path: str, scope):
+    async def get_response(self, path: str, scope: MutableMapping[str, Any]) -> Response:
         try:
             return await super().get_response(path, scope)
         except Exception: