ZAP API Scan Report

- Site: [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 68:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 70:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **A Client Error response code was returned by the server** [100000] total: 2:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense)
- **Non-Storable Content** [10049] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-STUDENT-DATA-COLLECTION-API/actions/runs/5966822121) to download the report.
RunnerID:5966822121

Download the ZAP report from GitHub Actions run 5966822121 and review the findings for the API and its /v3/api-docs endpoint. No source files or tests are named, so first identify where the Java API configures responses and security headers. Done means the reported alerts are addressed and the ZAP scan no longer reports them.

Written by the indexing model from the issue text.