The Convercent Whistleblowing Platform operated by EQS Group contains a protection mechanism failure in its browser and session handling. By default, affected deployments omit HTTP security headers such as Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, implement incomplete clickjacking protections. The application also issues cookies with insecure or inconsistent attributes including duplicate ASP.NET_SessionId values, an affinity cookie missing the Secure attribute, mixed absent SameSite settings. These deficiencies weaken browser-side isolation integrity, increasing exposure to client-side attacks, fixation, cross-site leakage.