Will It Vibe?Session cookie hardening never configured
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A Flask app uses sessions (app.secret_key/SECRET_KEY and flask.session) but the repo never sets SESSION_COOKIE_SECURE or SESSION_COOKIE_HTTPONLY, so it runs on Flask defaults, and SESSION_COOKIE_SECURE defaults to False. Heuristic: the settings could be applied through a config object this scan cannot resolve, so this is a prompt to confirm rather than a confirmed defect.
Why it matters
Flask's SESSION_COOKIE_SECURE setting defaults to False, meaning the session cookie is sent over plain HTTP unless something in the app explicitly turns that off. A session cookie sent in cleartext can be captured by anyone on the same network path, and a session cookie that is also missing HttpOnly is readable by any JavaScript on the page, turning a single XSS bug into full session theft.
How to fix it
Set app.config["SESSION_COOKIE_SECURE"] = True and app.config["SESSION_COOKIE_HTTPONLY"] = True (the latter is actually Flask's default already, but setting it explicitly documents the intent) wherever the app builds its production configuration. Pair this with SESSION_COOKIE_SAMESITE = "Lax" or "Strict" for defense in depth against CSRF.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo