[security] M-8: SESSION_COOKIE_SECURE defaults to False

[jacobyoby]

Severity: Medium
File: setup.py:102

Problem

Session cookies can be transmitted over unencrypted HTTP connections by default.

Remediation

Default SESSION_COOKIE_SECURE to True. Require HTTPS for session cookies in production configurations.

Source

Finding from security audit (2026-08-31). See .github/SECURITY_AUDIT_TRIAGE.md.