ZAP API Scan Report

- Site: [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 68:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 70:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **A Client Error response code was returned by the server** [100000] total: 2:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense)

View the [following link](https://github.com/bcgov/EDUC-STUDENT-DATA-COLLECTION-API/actions/runs/9229115176) to download the report.
RunnerID:9229115176

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start by downloading the ZAP report from the linked GitHub Actions run and review the findings for the listed API endpoints, especially /v3/api-docs. Trace how the API produces its response headers, status codes, and content types. Done means the reported security alerts and unexpected responses have been investigated and the applicable findings are resolved or documented.

Written by the indexing model from the issue text.