ZAP API Scan Report

- Site: [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 68:
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 70:
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **A Client Error response code was returned by the server** [100000] total: 2:
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca?aaa=bbb](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca?aaa=bbb)
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense)
- **Non-Storable Content** [10049] total: 1:
- [https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-test-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-STUDENT-DATA-COLLECTION-API/actions/runs/9120563820) to download the report.
RunnerID:9120563820

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start with the linked GitHub Actions run and its downloadable ZAP report, then review the listed API endpoints and alert categories. The issue is complete when the relevant findings have been addressed or explained and the ZAP scan has been rerun with results recorded.

Written by the indexing model from the issue text.