ZAP API Scan Report

- Site: [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Cookie with SameSite Attribute None** [10054] total: 12:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return)
- ..
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 1:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 4:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- **Non-Storable Content** [10049] total: 12:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return)
- ..
- **Session Management Response Identified** [10112] total: 12:
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v2/send-email)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/complete?demographicsChanged=true)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/info)
- [https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return](https://student-profile-email-api-8878b4-dev.apps.silver.devops.gov.bc.ca/gmp/notify-stale-return)
- ..

View the [following link](https://github.com/bcgov/EDUC-STUDENT-PROFILE-EMAIL-API/actions/runs/13183665627) to download the report.
RunnerID:13183665627

---
[ZAP by Checkmarx](https://checkmarx.com/)

Open the linked GitHub Actions run and download the ZAP report, then review the listed API endpoints and alert IDs 10054, 10023, 90004, 100001, 10049, and 10112. Determine which findings apply to the application rather than the deployment environment; done means the applicable alerts are addressed or justified and the ZAP scan is rerun successfully.

Written by the indexing model from the issue text.