ZAP API Scan Report

- Site: [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **A Server Error response code was returned by the server** [100000] total: 1:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- **Cookie with SameSite Attribute None** [10054] total: 12:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return)
- ..
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 1:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- **A Client Error response code was returned by the server** [100000] total: 175:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/7242330747490862657](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/7242330747490862657)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/)
- ..
- **Non-Storable Content** [10049] total: 12:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return)
- ..
- **Session Management Response Identified** [10112] total: 12:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return)
- ..

View the [following link](https://github.com/bcgov/EDUC-STUDENT-PROFILE-EMAIL-API/actions/runs/11074189528) to download the report.
RunnerID:11074189528

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the linked ZAP report and review the listed endpoints, especially /latest/meta-data/ and /v3/api-docs. Triage each alert to determine which findings are actionable versus expected scanner results, then rerun the ZAP API scan. Done means the actionable alerts are resolved or documented with their rationale.

Written by the indexing model from the issue text.