Qualified static finding recorded.
CodeVetter · local evidence export
Insecure session cookie attributes in TypeScript
codevetter-public-benchmark/ts-insecure-cookie
detected · high confidence
Verification
No exact-current runtime evidence is included.
No audience validation occurred.
Finding
insecure cookie
The session cookie is set without Secure, HttpOnly, or SameSite attributes, so it is transmitted over HTTP, readable by JavaScript/XSS, and vulnerable to CSRF.
source.ts:8