ZAP API Scan Report

- Site: [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Spring Actuator Information Leak** [40042] total: 1:
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- **Cookie with SameSite Attribute None** [10054] total: 1:
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/api/v1/challenge-reports/challenge-report-status-codes](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/api/v1/challenge-reports/challenge-report-status-codes)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 1:
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 4:
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- **Non-Storable Content** [10049] total: 2:
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/api/v1/challenge-reports/challenge-report-status-codes](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/api/v1/challenge-reports/challenge-report-status-codes)
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Session Management Response Identified** [10112] total: 2:
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/api/v1/challenge-reports/challenge-report-status-codes](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/api/v1/challenge-reports/challenge-report-status-codes)
- [https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://challenge-reports-api-e14b44-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-CHALLENGE-REPORTS-API/actions/runs/14982024048) to download the report.
RunnerID:14982024048

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the linked ZAP report and GitHub Actions run 14982024048, then review each alert against the listed actuator, API, and OpenAPI endpoints. Determine which findings require changes and rerun the ZAP API scan; done means the actionable alerts are resolved or explicitly documented as accepted exceptions.

Written by the indexing model from the issue text.