Will It Vibe?Cookie set with no security flags
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
res.cookie is called with only a name and value and no options object, so the cookie is missing httpOnly, secure, and sameSite; for a session or auth cookie that exposes it to script theft and cross-site sending.
Why it matters
A res.cookie call with only a name and value carries no httpOnly, secure, or sameSite flags. Without httpOnly the cookie is readable by any script on the page, so an XSS bug can steal a session; without secure it is sent over plain HTTP; without sameSite it rides along on cross-site requests. For auth or session cookies this turns smaller bugs into account takeover.
How to fix it
Pass an options object on every cookie that carries anything sensitive: res.cookie(name, value, { httpOnly: true, secure: true, sameSite: 'lax' }). Use sameSite 'strict' where it does not break flows, and set a sensible maxAge. For non-sensitive cookies read by client code, at least keep secure and sameSite.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo