## Findings
No Content-Security-Policy headerMedium
The response headers contain no content-security-policy.
Session cookie missing the Secure flagMedium
Set-Cookie for the session is sent without Secure.
Server header discloses a versionLow
The Server header names the software and its version.
## Recommended next steps
1. Add a Content-Security-Policy header.
2. Set the Secure flag on the session cookie.
Lugescan