ZAP API Scan Report

- Site: [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 10:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/3508647013561450217](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/3508647013561450217)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 10:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/3508647013561450217](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/3508647013561450217)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-EAS-API/actions/runs/11526304439) to download the report.
RunnerID:11526304439

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Download the ZAP report from the linked GitHub Actions run and review the alerts against the listed API endpoints. Start by reproducing the scan or checking the reported responses, then determine the affected application areas. Done means the reported security headers, server errors, content types, and non-storable content findings are addressed and the scan no longer reports them.

Written by the indexing model from the issue text.