https://shipreadyai.dev/learn/findings/o9-cookies-ok

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Cookies on the first response look fine

No cookie was set without its protective flags on this response.

## Why AI-built apps get this

Session cookies come from whatever library the agent reached for, with whatever defaults it ships. Secure, HttpOnly and SameSite are three small settings that turn a scripting bug into an account takeover when they are missing, and nothing in your app looks wrong when they are.

## Evidence line

set-cookie: session=abc; Path=/ with no HttpOnly and no SameSite

## The fix

Nothing to change here.

## Prompt

Keep the protective flags on every cookie.