ZAP API Scan Report

- Site: [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
**New Alerts**
- **CSP: Wildcard Directive** [10055] total: 1:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- **CSP: style-src unsafe-inline** [10055] total: 1:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- **Hidden File Found** [40035] total: 4:
- [https://dev.getmypen.gov.bc.ca/._darcs](https://dev.getmypen.gov.bc.ca/._darcs)
- [https://dev.getmypen.gov.bc.ca/.bzr](https://dev.getmypen.gov.bc.ca/.bzr)
- [https://dev.getmypen.gov.bc.ca/.hg](https://dev.getmypen.gov.bc.ca/.hg)
- [https://dev.getmypen.gov.bc.ca/BitKeeper](https://dev.getmypen.gov.bc.ca/BitKeeper)
- **Sub Resource Integrity Attribute Missing** [90003] total: 2:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- **A Server Error response code was returned by the server** [100000] total: 1:
- [https://dev.getmypen.gov.bc.ca/latest/meta-data/](https://dev.getmypen.gov.bc.ca/latest/meta-data/)
- **Cookie with SameSite Attribute None** [10054] total: 1:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- **Deprecated Feature Policy Header Set** [10063] total: 1:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- **Unexpected Content-Type was returned** [100001] total: 59:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/._darcs](https://dev.getmypen.gov.bc.ca/._darcs)
- [https://dev.getmypen.gov.bc.ca/.bzr](https://dev.getmypen.gov.bc.ca/.bzr)
- [https://dev.getmypen.gov.bc.ca/.DS_Store](https://dev.getmypen.gov.bc.ca/.DS_Store)
- ..
- **A Client Error response code was returned by the server** [100000] total: 2:
- [https://dev.getmypen.gov.bc.ca?aaa=bbb](https://dev.getmypen.gov.bc.ca?aaa=bbb)
- [https://dev.getmypen.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense](https://dev.getmypen.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense)
- **Modern Web Application** [10109] total: 1:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- **Non-Storable Content** [10049] total: 1:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- **Session Management Response Identified** [10112] total: 1:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)

View the [following link](https://github.com/bcgov/EDUC-STUDENT-PROFILE/actions/runs/8364047956) to download the report.
RunnerID:8364047956

Start by downloading and reviewing the ZAP report linked from the issue and compare its findings with the deployed site. Triage the listed headers, hidden paths, response codes, content types, and cookie findings; done means the relevant alerts are addressed or documented and a follow-up ZAP scan confirms the result.

Written by the indexing model from the issue text.