ZAP API Scan Report

- Site: [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Cookie with SameSite Attribute None** [10054] total: 11:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID?includeDocData=Y](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID?includeDocData=Y)
- ..
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 1:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 4:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- **Non-Storable Content** [10049] total: 13:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro?macroTypeCode=macroTypeCode](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro?macroTypeCode=macroTypeCode)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents)
- ..
- **Session Management Response Identified** [10112] total: 12:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro?macroTypeCode=macroTypeCode](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro?macroTypeCode=macroTypeCode)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents)
- ..

View the [following link](https://github.com/bcgov/EDUC-PEN-REQUEST-API/actions/runs/13446020115) to download the report.
RunnerID:13446020115

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the linked ZAP report from GitHub Actions run 13446020115 and review the listed API endpoints, especially /v3/api-docs and the document, macro, and comments routes. Confirm which alerts are actionable versus expected behavior, then trace each affected endpoint in the Java API. Done means the findings are addressed or explicitly documented with a clean follow-up scan.

Written by the indexing model from the issue text.