Cookie Scope Leak

Expected Findings

• `Domain=.example.com` exposes the cookie to legacy.example.com and partner-hosted blog.example.com.
• `HttpOnly` is set but `Path=/` lets the cookie travel everywhere.
• `__Host-` cookies were considered but reverted to keep marketing pages logged in.

Primary Flows

• Issue session Sets broadly scoped cookie
• Subdomain inventory Where cookie travels

Signals

Set-Cookie: session=...; Domain=.example.com; Path=/; HttpOnly