ZAP API Scan Report

- Site: [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Cookie with SameSite Attribute None** [10054] total: 12:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- ..
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 1:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 4:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- **Non-Storable Content** [10049] total: 12:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- ..
- **Session Management Response Identified** [10112] total: 12:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- ..

View the [following link](https://github.com/bcgov/EDUC-PEN-NOMINAL-ROLL-API/actions/runs/14251277503) to download the report.
RunnerID:14251277503

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start by downloading the ZAP report from the linked GitHub Actions run and reviewing the listed alerts and affected API endpoints. No source files or tests are named, so trace each finding into the Java API entry points before deciding the required changes. Done means the findings have been addressed or explicitly assessed and a follow-up scan verifies the result.

Written by the indexing model from the issue text.