Why it matters
Cookies often hold the thing that keeps users logged in. Without these flags, a malicious script or an insecure connection can steal them.
How to check it yourself
In DevTools, open Application, then Cookies, and look at the Secure, HttpOnly and SameSite columns for each cookie your site sets. Blank cells on a login cookie are the problem.
What the fix involves
Set Secure and SameSite=Lax (or Strict) on every cookie, and HttpOnly on anything JavaScript doesn't need to read. With an auth library this is usually a cookie options block in its config.
Reference: developer.mozilla.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.