ZAP API Scan Report

- Site: [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Spring Actuator Information Leak** [40042] total: 1:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- **A Server Error response code was returned by the server** [100000] total: 7:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 5:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login)
- **Cross-Origin-Resource-Policy Header Missing or Invalid** [90004] total: 1:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 7:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **A Client Error response code was returned by the server** [100000] total: 25:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/1253679837474225904](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/1253679837474225904)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/)
- ..
- **Non-Storable Content** [10049] total: 5:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login)
- **Session Management Response Identified** [10112] total: 7:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- ..

View the [following link](https://github.com/bcgov/EDUC-SOAM-API/actions/runs/28896192565) to download the report.
RunnerID:28896192565

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start by downloading the ZAP report from GitHub Actions run 28896192565 and review the listed endpoints, beginning with /actuator/health and /v3/api-docs. Determine which alerts are actual application findings versus scan responses, then verify that the report is clean or that accepted exceptions are documented.

Written by the indexing model from the issue text.