ZAP Scan Baseline Report

- Site: [https://test-drivebc.apps.gold.devops.gov.bc.ca](https://test-drivebc.apps.gold.devops.gov.bc.ca)
**New Alerts**
- **Cross-Origin-Embedder-Policy Header Missing or Invalid** [90004] total: 2:
- [https://test-drivebc.apps.gold.devops.gov.bc.ca/](https://test-drivebc.apps.gold.devops.gov.bc.ca/)
- [https://test-drivebc.apps.gold.devops.gov.bc.ca/sitemap.xml](https://test-drivebc.apps.gold.devops.gov.bc.ca/sitemap.xml)
- **Cross-Origin-Opener-Policy Header Missing or Invalid** [90004] total: 2:
- [https://test-drivebc.apps.gold.devops.gov.bc.ca/](https://test-drivebc.apps.gold.devops.gov.bc.ca/)
- [https://test-drivebc.apps.gold.devops.gov.bc.ca/sitemap.xml](https://test-drivebc.apps.gold.devops.gov.bc.ca/sitemap.xml)

**Ignored Alerts**
- **CSP: script-src unsafe-inline** [10055] total: 2:
- **CSP: style-src unsafe-inline** [10055] total: 2:
- **Modern Web Application** [10109] total: 2:
- **Re-examine Cache-control Directives** [10015] total: 4:
- **Storable and Cacheable Content** [10049] total: 5:
- **Storable but Non-Cacheable Content** [10049] total: 2:

View the [following link](https://github.com/bcgov/DriveBC.ca/actions/runs/25978161022) to download the report.
RunnerID:25978161022

---
[ZAP by Checkmarx](https://checkmarx.com/)

Download the ZAP report from the linked GitHub Actions run and review alerts 90004 for the site root and sitemap.xml. Identify where the application configures response headers, then verify both Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy are valid and the two reported alerts no longer occur.

Written by the indexing model from the issue text.