ZAP API Scan Report

- Site: [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 67:
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 67:
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-algorithm-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)

View the [following link](https://github.com/bcgov/EDUC-GRAD-ALGORITHM-API/actions/runs/4018957853) to download the report.
RunnerID:4018957853

Start by downloading the ZAP report from the linked GitHub Actions run and reviewing the findings for /api/v1/api-docs and the listed root and hidden paths. Trace how the API serves these endpoints and identify whether the reported headers, server errors, and content types are expected. Done means the findings are addressed or explicitly assessed, then verified with a new ZAP scan.

Written by the indexing model from the issue text.