[banana_giraffe]

I don't think I've ever seen it called out, but I always assumed it's "Secure" in the sense it hasn't been modified by a script.

But that's 100% a guess on my part.

[herpderperator]

Great, so now we have the HttpOnly flag for cookies which differs from the Secure flag for cookies, while the Secure in the Sec headers has the same meaning as HttpOnly.

[billyhoffman]

And we have SameSite in Cookies, and Allow-Origin in headers!