ZAP Full Scan Report

- Site: [https://strapi-api-host-staging.app.cloud.gov](https://strapi-api-host-staging.app.cloud.gov)
**New Alerts**
- **Modern Web Application** [10109] total: 11:
- [https://strapi-api-host-staging.app.cloud.gov/login](https://strapi-api-host-staging.app.cloud.gov/login)
- [https://strapi-api-host-staging.app.cloud.gov/homepage](https://strapi-api-host-staging.app.cloud.gov/homepage)
- [https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js](https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js)
- [https://strapi-api-host-staging.app.cloud.gov/logout](https://strapi-api-host-staging.app.cloud.gov/logout)
- [https://strapi-api-host-staging.app.cloud.gov/](https://strapi-api-host-staging.app.cloud.gov/)
- ..
- **Incomplete or No Cache-control and Pragma HTTP Header Set** [10015] total: 11:
- [https://strapi-api-host-staging.app.cloud.gov/static/css/main.cdb47071.chunk.css](https://strapi-api-host-staging.app.cloud.gov/static/css/main.cdb47071.chunk.css)
- [https://strapi-api-host-staging.app.cloud.gov/](https://strapi-api-host-staging.app.cloud.gov/)
- [https://strapi-api-host-staging.app.cloud.gov/static/css/2.55d8add8.chunk.css](https://strapi-api-host-staging.app.cloud.gov/static/css/2.55d8add8.chunk.css)
- [https://strapi-api-host-staging.app.cloud.gov/manifest.json](https://strapi-api-host-staging.app.cloud.gov/manifest.json)
- [https://strapi-api-host-staging.app.cloud.gov/bok](https://strapi-api-host-staging.app.cloud.gov/bok)
- ..
- **CSP: script-src unsafe-inline** [10055] total: 3:
- [https://strapi-api-host-staging.app.cloud.gov/about](https://strapi-api-host-staging.app.cloud.gov/about)
- [https://strapi-api-host-staging.app.cloud.gov/](https://strapi-api-host-staging.app.cloud.gov/)
- [https://strapi-api-host-staging.app.cloud.gov/homepage](https://strapi-api-host-staging.app.cloud.gov/homepage)
- **Cross-Domain JavaScript Source File Inclusion** [10017] total: 11:
- [https://strapi-api-host-staging.app.cloud.gov/challenge](https://strapi-api-host-staging.app.cloud.gov/challenge)
- [https://strapi-api-host-staging.app.cloud.gov/about](https://strapi-api-host-staging.app.cloud.gov/about)
- [https://strapi-api-host-staging.app.cloud.gov/bok](https://strapi-api-host-staging.app.cloud.gov/bok)
- [https://strapi-api-host-staging.app.cloud.gov/submit](https://strapi-api-host-staging.app.cloud.gov/submit)
- [https://strapi-api-host-staging.app.cloud.gov/logout](https://strapi-api-host-staging.app.cloud.gov/logout)
- ..
- **CSP: Wildcard Directive** [10055] total: 3:
- [https://strapi-api-host-staging.app.cloud.gov/homepage](https://strapi-api-host-staging.app.cloud.gov/homepage)
- [https://strapi-api-host-staging.app.cloud.gov/](https://strapi-api-host-staging.app.cloud.gov/)
- [https://strapi-api-host-staging.app.cloud.gov/about](https://strapi-api-host-staging.app.cloud.gov/about)
- **CSP: style-src unsafe-inline** [10055] total: 3:
- [https://strapi-api-host-staging.app.cloud.gov/about](https://strapi-api-host-staging.app.cloud.gov/about)
- [https://strapi-api-host-staging.app.cloud.gov/homepage](https://strapi-api-host-staging.app.cloud.gov/homepage)
- [https://strapi-api-host-staging.app.cloud.gov/](https://strapi-api-host-staging.app.cloud.gov/)
- **Timestamp Disclosure - Unix** [10096] total: 14:
- [https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js](https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js)
- [https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js](https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js)
- [https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js](https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js)
- [https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js](https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js)
- [https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js](https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 2:
- [https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js](https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js)
- [https://strapi-api-host-staging.app.cloud.gov/static/js/main.7caf7efe.chunk.js](https://strapi-api-host-staging.app.cloud.gov/static/js/main.7caf7efe.chunk.js)
- **Application Error Disclosure** [90022] total: 1:
- [https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js](https://strapi-api-host-staging.app.cloud.gov/static/js/2.b9fa3d4a.chunk.js)

- Site: [http://strapi-api-host-staging.app.cloud.gov](http://strapi-api-host-staging.app.cloud.gov)
**New Alerts**
- **User Agent Fuzzer** [10104] total: 20:
- [http://strapi-api-host-staging.app.cloud.gov/sitemap.xml](http://strapi-api-host-staging.app.cloud.gov/sitemap.xml)
- [http://strapi-api-host-staging.app.cloud.gov/robots.txt](http://strapi-api-host-staging.app.cloud.gov/robots.txt)
- [http://strapi-api-host-staging.app.cloud.gov/](http://strapi-api-host-staging.app.cloud.gov/)
- [http://strapi-api-host-staging.app.cloud.gov/robots.txt](http://strapi-api-host-staging.app.cloud.gov/robots.txt)
- [http://strapi-api-host-staging.app.cloud.gov/robots.txt](http://strapi-api-host-staging.app.cloud.gov/robots.txt)
- ..

View the [following link](https://github.com/GSA/ai-experience-sharing-platform/actions/runs/582030507) to download the report.
RunnerID:582030507

The issue names no source files; start by downloading the ZAP report from the linked GitHub Actions run and reviewing the listed alerts and affected URLs. Done means each reported alert has been addressed or explicitly triaged, with a new scan confirming the resulting findings.

Written by the indexing model from the issue text.