diff --git a/README.md b/README.md
index 5a61bf7..508dae4 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,7 @@ Fresh full-stack starter scaffold:
 ## Implemented Backend Scope
 
 - Auth: register, login, logout, current user context
+- Session cookie: `HttpOnly`, `SameSite=Strict`, `Secure` when served over HTTPS
 - Rulesets: d6 and dnd5e validation rules
 - Campaigns: create/list/read
 - Characters: create/update/activate/current-campaign list