ZAP API Scan Report

- Site: [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 68:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 70:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **A Client Error response code was returned by the server** [100000] total: 2:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense)

View the [following link](https://github.com/bcgov/EDUC-STUDENT-DATA-COLLECTION-API/actions/runs/9227885957) to download the report.
RunnerID:9227885957

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start with the linked GitHub Actions ZAP report and review the listed API endpoints and alerts, especially the missing CSP and Strict-Transport-Security headers. Reproduce the scan against the reported site to determine which findings are actionable. Done means the applicable alerts are addressed and the ZAP scan no longer reports them.

Written by the indexing model from the issue text.