ZAP API Scan Report

- Site: [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 10:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/584445718230127289](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/584445718230127289)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 10:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/584445718230127289](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/584445718230127289)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://eas-api-dc93db-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-EAS-API/actions/runs/11963944995) to download the report.
RunnerID:11963944995

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Download the ZAP report from GitHub Actions run 11963944995 and review the findings for the listed API endpoints, especially /v3/api-docs and the server-error responses. Trace each alert to the API entry points and determine what evidence is needed to confirm the issue is addressed. Done means the relevant findings are resolved or explained and a subsequent ZAP scan no longer reports them.

Written by the indexing model from the issue text.