Will It Vibe?SESSION_COOKIE_SECURE disabled
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
SESSION_COOKIE_SECURE = False allows the session cookie to be sent over plain HTTP, so it can be captured by anyone on the network path between the client and server.
Why it matters
SESSION_COOKIE_SECURE = False allows the browser to send the session cookie over a plain HTTP connection, not just HTTPS. Anyone positioned on the network path, a coffee-shop Wi-Fi, a compromised router, a malicious exit node, can read that cookie in transit and hijack the session it belongs to.
How to fix it
Set SESSION_COOKIE_SECURE = True in any settings actually served over HTTPS, so browsers only ever send the cookie on a secure connection. Pair it with SESSION_COOKIE_HTTPONLY = True (the Django default) and consider SESSION_COOKIE_SAMESITE = "Lax" or "Strict" for additional CSRF-adjacent protection.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo