A clear path forward
Why does a PCI or security scan flag the GAESA cookie on my published app?
Google's serving infrastructure adds the GAESA cookie to published Replit apps to route requests to the right instance. The GAESA cookie's value is an opaque routing identifier and carries no sensitive or application data.
Some security scanners flag GAESA because it doesn't set the Secure or HttpOnly attributes. Your app doesn't create the GAESA cookie, and you can't change or disable it for a published app.
If a PCI compliance or security scan reports this cookie, dispute the finding with the scan vendor as a false positive. Include the cookie name and explain that Google's infrastructure sets it for request routing. Your published app can't read, change, or disable it, and the cookie carries no sensitive data.
Compliance for the app you build is your responsibility, and if your scan vendor needs more detail, you should contact Replit Support.
Did this get you unstuck?
Still stuck?
See what to include and open a support ticket.
Still stuck?
See what to include and open a support ticket.If this page did not solve it, contact Support and describe what you were trying to do and what happened, in your own words. You do not need to gather anything in advance.
Include in your ticket, if you know it
- What you were trying to do
- What happened, in your own words
- What you have already tried, if anything
Copying is optional. No ticket is submitted and no files are attached automatically; send your request in the support form.
Do not include passwords, API keys, or payment-card details.