Just expanding on that, the cookie is a hash of “a secret string” (stored either in environment or Redis) and data in the database. There is no risk that the auth cookie can leak unless environment or redis is exposed as well. If a DB is exposed the biggest risk is that passwords and emails can leak. In particular BAD passwords can potentially be brute force attacked since the salt is stored in the database. Keep in mind though 10 char passwords (which is our minimal default is not that easy to brute force attack)