ZAP API Scan Report

- Site: [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 10:
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca)
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/3393773435575642117](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/3393773435575642117)
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 10:
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca)
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/3393773435575642117](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/3393773435575642117)
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://scholarships-api-e14b44-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-SCHOLARSHIPS-API/actions/runs/11526869289) to download the report.
RunnerID:11526869289

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start with the ZAP report linked from the issue and reproduce the findings against the listed API endpoints, including /v3/api-docs and /actuator/health. Trace the server-error, content-type, and missing-header responses to their relevant application or deployment configuration. Done means the intended responses and security headers are present and the ZAP scan no longer reports these alerts.

Written by the indexing model from the issue text.