bcgov / bcgov/EDUC-SERVICES-CARD-API
ZAP API Scan Report
- Dominant language
- Java
- Stars
- 4
- Forks
- 1
- Avg merge
- 7d 9h
- Merged PRs (30d)
- 5
Description
- Site: [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 16:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/9188872993812011377](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/9188872993812011377)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 16:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/9188872993812011377](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/9188872993812011377)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
View the [following link](https://github.com/bcgov/EDUC-SERVICES-CARD-API/actions/runs/23359196203) to download the report.
RunnerID:23359196203
---
[ZAP by Checkmarx](https://checkmarx.com/)
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by downloading the ZAP report from the linked GitHub Actions run and review the listed endpoints and alerts. Inspect the API's response handling and security-header configuration, then rerun the ZAP scan to confirm the reported alerts and unexpected server responses are addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100