ZAP API Scan Report

- Site: [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Cookie with SameSite Attribute None** [10054] total: 14:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/report/type/download](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/report/type/download)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=%7B%22condition%22:%22AND%22,%22searchCriteriaList%22:%5B%7B%22key%22:%22John%20Doe%22,%22operation%22:%22eq%22,%22value%22:%22John%20Doe%22,%22valueType%22:%22STRING%22,%22condition%22:%22AND%22%7D%5D%7D](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=%7B%22condition%22:%22AND%22,%22searchCriteriaList%22:%5B%7B%22key%22:%22John%20Doe%22,%22operation%22:%22eq%22,%22value%22:%22John%20Doe%22,%22valueType%22:%22STRING%22,%22condition%22:%22AND%22%7D%5D%7D)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events)
- ..
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 1:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 4:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- **Non-Storable Content** [10049] total: 12:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- ..
- **Session Management Response Identified** [10112] total: 13:
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll?processingYear=processingYear)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/nomRollStudentID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=%7B%22condition%22:%22AND%22,%22searchCriteriaList%22:%5B%7B%22key%22:%22John%20Doe%22,%22operation%22:%22eq%22,%22value%22:%22John%20Doe%22,%22valueType%22:%22STRING%22,%22condition%22:%22AND%22%7D%5D%7D](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=%7B%22condition%22:%22AND%22,%22searchCriteriaList%22:%5B%7B%22key%22:%22John%20Doe%22,%22operation%22:%22eq%22,%22value%22:%22John%20Doe%22,%22valueType%22:%22STRING%22,%22condition%22:%22AND%22%7D%5D%7D)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaID)
- [https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events](https://pen-nominal-roll-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/nominal-roll/saga/sagaId/saga-events)
- ..

View the [following link](https://github.com/bcgov/EDUC-PEN-NOMINAL-ROLL-API/actions/runs/14629499635) to download the report.
RunnerID:14629499635

---
[ZAP by Checkmarx](https://checkmarx.com/)

Download the ZAP report from the linked GitHub Actions run and review the listed alerts and affected API endpoints. Trace each finding to the relevant application or deployment configuration, then rerun the ZAP scan. Done means the reported findings are addressed or explicitly assessed and the scan results are verified.

Written by the indexing model from the issue text.