ZAP API Scan Report

- Site: [https://coreg-api--dev.apps.silver.devops.gov.bc.ca](https://coreg-api--dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 10:
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca](https://coreg-api--dev.apps.silver.devops.gov.bc.ca)
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/)
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/1952193477854647930](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/1952193477854647930)
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/actuator/health](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 10:
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca](https://coreg-api--dev.apps.silver.devops.gov.bc.ca)
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/)
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/1952193477854647930](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/1952193477854647930)
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/actuator/health](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://coreg-api--dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://coreg-api--dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-COREG-API/actions/runs/12423171386) to download the report.
RunnerID:12423171386

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start by downloading the ZAP report from GitHub Actions run 12423171386 and reviewing the listed endpoints, including /v3/api-docs, /actuator/health, and /latest/meta-data/. No source files or tests are named, so trace these endpoints in the Java API and reproduce the scan findings. Done means the reported alerts are addressed and the ZAP scan passes without them.

Written by the indexing model from the issue text.