Cookie missing HttpOnly
A non-session cookie does not set HttpOnly.
Why it matters
Analytics and preference cookies often omit HttpOnly so scripts can read them. That is only safe if the value is not a credential.
What to do
Add HttpOnly when JavaScript does not need the value.
Reference
Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.