ZAP API Scan Report

- Site: [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 13:
- [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/1963303306333544300](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/1963303306333544300)
- [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://scholarships-api-e14b44-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-SCHOLARSHIPS-API/actions/runs/18730910757) to download the report.
RunnerID:18730910757

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start with the ZAP report from GitHub Actions run 18730910757 and inspect the listed /v3/api-docs, root, /actuator/health, and other reported endpoints. Determine where the response headers and content types are configured, then rerun the ZAP API scan. Done means the listed alerts are resolved or explicitly reviewed with the resulting report.

Written by the indexing model from the issue text.