Cookie missing Secure
A cookie set on an HTTPS response does not have the Secure attribute.
Why it matters
The browser may send that cookie if the user is later sent to HTTP, where it can be read on the network.
What to do
Add Secure to every cookie on HTTPS.
Reference
Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.