ZAP API Scan Report

- Site: [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 11:
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess)
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/6675997195575770365](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/6675997195575770365)
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/elmah.axd](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/elmah.axd)
- ..
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Timestamp Disclosure - Unix** [10096] total: 1:
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 11:
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess)
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/6675997195575770365](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/6675997195575770365)
- [https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/elmah.axd](https://pen-myed-api-afffe0-dev-dev.apps.silver.devops.gov.bc.ca/elmah.axd)
- ..

View the [following link](https://github.com/bcgov/EDUC-PEN-MYED-API/actions/runs/2283882058) to download the report.
RunnerID:2283882058

Start with the linked ZAP report and inspect the listed responses, especially /v3/api-docs and the endpoints returning server errors or unexpected content types. Determine which alerts are reproducible and address the reported security headers, timestamp disclosure, error responses, and content types. Done means the relevant findings are resolved and a new ZAP scan confirms the results.

Written by the indexing model from the issue text.