How is my session protected?

Your session is bound to the browser you signed in from, not to a specific site. BOLMOL stores session cookies with the Secure, HttpOnly, and SameSite=None attributes, and marks them Partitioned in modern browsers so a session in one partition cannot be read by another. Every state-changing request carries a CSRF token. Sign-in credentials are never stored on our side — they are handled entirely by Google or Microsoft.