Will It Vibe?Cookie set with HttpOnly disabled
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A cookie is configured with httpOnly: false, so client-side JavaScript can read it; for a session or auth cookie that turns any XSS into account theft.
Why it matters
A cookie set with httpOnly: false is readable by any JavaScript on the page, including injected scripts. For a session or authentication cookie that means a single XSS bug can exfiltrate the session and take over the account. HttpOnly is the flag that keeps such cookies out of reach of the DOM.
How to fix it
Set httpOnly: true on session and authentication cookies (it is the default in most frameworks, so usually the fix is to remove the explicit false). Only leave a cookie readable to scripts when the client genuinely needs its value and it carries nothing sensitive. Pair this with the Secure and SameSite flags.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo