ZAP API Scan Report

- Site: [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 10:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/5881761559986316782](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/5881761559986316782)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 10:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/5881761559986316782](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/5881761559986316782)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-EAS-API/actions/runs/11370588062) to download the report.
RunnerID:11370588062

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start by downloading the ZAP report from the linked GitHub Actions run and inspect the listed API endpoints, especially /v3/api-docs and /actuator/health. Reproduce the scan and trace the server errors, unexpected content types, and missing security headers to their relevant configuration. Done means the reported alerts are addressed or explained and the scan is rerun to verify the result.

Written by the indexing model from the issue text.