ZAP API Scan Report

- Site: [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Sub Resource Integrity Attribute Missing** [90003] total: 1:
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/metadata](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/metadata)
- **Cookie with SameSite Attribute None** [10054] total: 12:
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentstatus](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentstatus)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student)
- ..
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 2:
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/metadata](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/metadata)
- **Unexpected Content-Type was returned** [100001] total: 4:
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- **Information Disclosure - Sensitive Information in URL** [10024] total: 3:
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/archive?batchId=10&studentStatus=studentStatus&userName=userName](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/archive?batchId=10&studentStatus=studentStatus&userName=userName)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/distribution/studentid/studentID?batchId=10&activityCode=activityCode&username=username](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/distribution/studentid/studentID?batchId=10&activityCode=activityCode&username=username)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/distribution/batchid/10?userName=userName&activityCode=activityCode](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/distribution/batchid/10?userName=userName&activityCode=activityCode)
- **Non-Storable Content** [10049] total: 12:
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentstatus](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentstatus)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student)
- ..
- **Session Management Response Identified** [10112] total: 12:
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentID/optionalPrograms/optionalProgramID](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentID/optionalPrograms/optionalProgramID)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/courses/studentID)
- [https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentstatus](https://educ-grad-student-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentstatus)
- ..

View the [following link](https://github.com/bcgov/EDUC-GRAD-STUDENT-API/actions/runs/15765898649) to download the report.
RunnerID:15765898649

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the ZAP report from GitHub Actions run 15765898649 and review the listed /api/v1 endpoints, metadata paths, and response alerts. Determine which findings are actionable for the API, address the confirmed security issues, and rerun the ZAP scan to verify that the relevant alerts are resolved.

Written by the indexing model from the issue text.