ZAP API Scan Report

- Site: [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 68:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 70:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **A Client Error response code was returned by the server** [100000] total: 2:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb)
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense)
- **Non-Storable Content** [10049] total: 1:
- [https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-data-collection-api-d4cdde-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-STUDENT-DATA-COLLECTION-API/actions/runs/9945599553) to download the report.
RunnerID:9945599553

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Download the ZAP report from GitHub Actions run 9945599553 and review the findings against the deployed API, starting with /v3/api-docs and the listed root and query URLs. Done means each reported alert is resolved or explicitly assessed and the ZAP scan is rerun with the results recorded.

Written by the indexing model from the issue text.