Cookie policy
The short version: we only use strictly-necessary cookies. No advertising, no third-party tracking, no fingerprinting. Read on for the full list.
Last updated: September 21, 2026
We don't set any optional cookies today.
There's no advertising on VulnVerify and no advertising or analytics cookies. Product-usage analytics (via PostHog) are collected server-side — usage events only, never search content or browser fingerprinting — and set no cookies in your browser. Page-view and page-speed telemetry (Vercel Web Analytics and Speed Insights) is collected in your browser, also without cookies and without fingerprinting. There are no embedded social widgets. The cookies below are required for sign-in and CSRF protection.
Cookies and browser storage we set
These are the production names — the ones you will see in your browser on vulnverify.com. The __Secure- and __Host- prefixes are part of the name and make the browser itself refuse the cookie over plain HTTP. In local development the same cookies appear without those prefixes.
| Cookie | Category | Purpose | Retention |
|---|---|---|---|
| __Secure-authjs.session-token | Strictly necessary | Signed JWT that proves you're logged in. Removed when you sign out, and it stops being accepted 24 hours after you sign in — auth.config.ts stamps that absolute expiry into the token when it is issued and refuses the token once it passes. Staying active does not extend it. | 24 hours |
| __Host-authjs.csrf-token | Strictly necessary | Cross-site-request-forgery protection token paired with auth flows. | Session |
| __Secure-authjs.callback-url | Strictly necessary | Remembers where you were trying to go when redirected to sign in. | Session |
| vv-cookie-consent | Strictly necessary · localStorage, not a cookie | Stores your cookie consent choice in localStorage (browser-only — never sent to our server). | Until you clear browser data |
Third-party cookies
If you use the “Continue with Google” sign-in option, Google sets cookies on its own domain (accounts.google.com) for the duration of the OAuth handshake. We do not control or read those cookies — see Google's policy.
Subscription payments are processed by Stripe; Stripe's hosted checkout may set its own cookies on *.stripe.com. See Stripe's privacy policy.
Changing your consent
Click in the footer to re-open the consent banner at any time. You can also clear your browser cookies for vulnverify.comto reset everything — you'll just need to sign in again.
Questions
Mail privacy@vulnverify.com. Full data-handling details are in the Privacy Policy.