Web security

Cookie security audit

We fetch your URL once, parse every Set-Cookie header, and grade Secure, HttpOnly, and SameSite per cookie. Three flags that decide whether XSS can exfiltrate sessions.