ERT-CONFIG-017
Cookies without Secure flag
LowA02:2025CWE-614
Why it matters
Security headers, TLS, email spoofing, takeovers. This check looks specifically for: cookies without secure flag.
How to fix it
Set Secure, HttpOnly and SameSite=Lax on cookies.
How we test it
Passive — runs in the free check, looks only at what a browser can see.