CheckVibeCodeCheckVibeCode
Checks/Configuration
ConfigurationLive6 checks

Cookie & Session Security Scanner

Audit cookie flags, session management, and token security for your application.

Run this scanSee pricing

What we check

  • Secure flag on every cookie set over HTTPS
  • HttpOnly flag on session/auth-shaped cookies
  • SameSite attribute set — and not None without Secure
  • Session cookie name doesn't leak framework/version (PHPSESSID, default Express connect.sid)
  • Cookie expiry — session vs. persistent, and whether long-lived auth cookies exist
  • __Host- / __Secure- prefix usage on sensitive cookies

More checks in Configuration

Security Headers ScannerSSL/TLS Security ScannerMobile Interface ScannerContainer & IaC Misconfiguration ScannerSupabase Security ScannerFirebase Security Scanner