ZAP API Scan Report

- Site: [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 15:
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess)
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/1118868538593819976](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/1118868538593819976)
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api)
- ..
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **Timestamp Disclosure - Unix** [10096] total: 1:
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 15:
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess)
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/1118868538593819976](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/1118868538593819976)
- [https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api](https://educ-grad-graduation-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api)
- ..

View the [following link](https://github.com/bcgov/EDUC-GRAD-GRADUATION-API/actions/runs/2463530460) to download the report.
RunnerID:2463530460

Start with the linked GitHub Actions ZAP report and review the listed API endpoints and alerts, since no source file or test is named. Determine which CSP, HSTS, timestamp, server-error, and content-type findings require remediation; the work is done when the relevant findings are addressed and a follow-up scan no longer reports them.

Written by the indexing model from the issue text.