ZAP API Scan Report

- Site: [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Cookie with SameSite Attribute None** [10054] total: 11:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- ..
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 1:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 4:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- **Non-Storable Content** [10049] total: 12:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=%7B%22condition%22:%22AND%22,%22searchCriteriaList%22:%5B%7B%22key%22:%22John%20Doe%22,%22operation%22:%22eq%22,%22value%22:%22John%20Doe%22,%22valueType%22:%22STRING%22,%22condition%22:%22AND%22%7D%5D%7D](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=%7B%22condition%22:%22AND%22,%22searchCriteriaList%22:%5B%7B%22key%22:%22John%20Doe%22,%22operation%22:%22eq%22,%22value%22:%22John%20Doe%22,%22valueType%22:%22STRING%22,%22condition%22:%22AND%22%7D%5D%7D)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events)
- ..
- **Session Management Response Identified** [10112] total: 13:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=%7B%22condition%22:%22AND%22,%22searchCriteriaList%22:%5B%7B%22key%22:%22John%20Doe%22,%22operation%22:%22eq%22,%22value%22:%22John%20Doe%22,%22valueType%22:%22STRING%22,%22condition%22:%22AND%22%7D%5D%7D](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=%7B%22condition%22:%22AND%22,%22searchCriteriaList%22:%5B%7B%22key%22:%22John%20Doe%22,%22operation%22:%22eq%22,%22value%22:%22John%20Doe%22,%22valueType%22:%22STRING%22,%22condition%22:%22AND%22%7D%5D%7D)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events)
- ..

View the [following link](https://github.com/bcgov/EDUC-PEN-NOMINAL-ROLL-API/actions/runs/14525786384) to download the report.
RunnerID:14525786384

---
[ZAP by Checkmarx](https://checkmarx.com/)

Download the ZAP report from GitHub Actions run 14525786384 and review the listed alerts against the API entry points, including /v3/api-docs, /api/v1/nominal-roll, and the metadata paths. Determine which findings are actionable, address the confirmed security issues, and rerun the ZAP scan to verify that the relevant alerts are resolved or appropriately explained.

Written by the indexing model from the issue text.