Lovable
Cookie flags on a Lovable app
Lovable turns a chat into a hosted app. The preview URL and the production URL both serve HTML and JavaScript to anyone who opens them. Variables that the framework marks as public, and secrets pasted into a client component, travel with that bundle.
Secure, HttpOnly, and SameSite on cookies the page already sets.
What the scan can see
Each Set-Cookie on the document is checked for Secure, HttpOnly, and SameSite. The cookie value is not copied into the report. A response with no Set-Cookie is not flagged.
What it does not do
Cookies set later by JavaScript after the page loads, or on a path we do not fetch, are not seen.
A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
What to do next
Set the three flags on the server. Use SameSite=Lax unless the cookie is only needed on your own site, in which case Strict is tighter. Do not put a session secret in a cookie that script can read.
Questions
Does this open my Lovable project?
No. A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
Can the scan prove cookie flags is fully fixed?
Cookies set later by JavaScript after the page loads, or on a path we do not fetch, are not seen.
What should I do if the scan finds it?
Set the three flags on the server. Use SameSite=Lax unless the cookie is only needed on your own site, in which case Strict is tighter. Do not put a session secret in a cookie that script can read.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.