ZAP API Scan Report

- Site: [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/v3/api-docs](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 10:
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca)
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/)
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/5233524192567737647](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/5233524192567737647)
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/actuator/health](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/v3/api-docs](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/v3/api-docs](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 10:
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca)
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/)
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/5233524192567737647](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/5233524192567737647)
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/actuator/health](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/v3/api-docs](https://edx-api-d4cdde-test.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-EDX-API/actions/runs/11918742407) to download the report.
RunnerID:11918742407

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start with the linked GitHub Actions run and download the ZAP report, then review alert IDs 10038, 100000, 10063, 10035, 100001, and 10049 for the listed API endpoints. Trace the reported server errors, content types, and missing headers to the API behavior; done means a rerun no longer reports the identified alerts.

Written by the indexing model from the issue text.