ZAP Full Scan Report

- Site: [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
**New Alerts**
- **CSP: Wildcard Directive** [10055] total: 4:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **CSP: style-src unsafe-inline** [10055] total: 4:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **Hidden File Found** [40035] total: 4:
- [https://dev.getmypen.gov.bc.ca/._darcs](https://dev.getmypen.gov.bc.ca/._darcs)
- [https://dev.getmypen.gov.bc.ca/.bzr](https://dev.getmypen.gov.bc.ca/.bzr)
- [https://dev.getmypen.gov.bc.ca/.hg](https://dev.getmypen.gov.bc.ca/.hg)
- [https://dev.getmypen.gov.bc.ca/BitKeeper](https://dev.getmypen.gov.bc.ca/BitKeeper)
- **Proxy Disclosure** [40025] total: 10:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets](https://dev.getmypen.gov.bc.ca/assets)
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-CZdp4kPN.css](https://dev.getmypen.gov.bc.ca/assets/index-CZdp4kPN.css)
- ..
- **Sub Resource Integrity Attribute Missing** [90003] total: 8:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 2:
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- **Deprecated Feature Policy Header Set** [10063] total: 5:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **Timestamp Disclosure - Unix** [10096] total: 1:
- [https://dev.getmypen.gov.bc.ca/assets/index-CZdp4kPN.css](https://dev.getmypen.gov.bc.ca/assets/index-CZdp4kPN.css)
- **Cookie Slack Detector** [90027] total: 10:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets](https://dev.getmypen.gov.bc.ca/assets)
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-CZdp4kPN.css](https://dev.getmypen.gov.bc.ca/assets/index-CZdp4kPN.css)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 5:
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)
- **Modern Web Application** [10109] total: 4:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 8:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-CZdp4kPN.css](https://dev.getmypen.gov.bc.ca/assets/index-CZdp4kPN.css)
- [https://dev.getmypen.gov.bc.ca/bcid-apple-touch-icon.png](https://dev.getmypen.gov.bc.ca/bcid-apple-touch-icon.png)
- ..
- **Session Management Response Identified** [10112] total: 3:
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js](https://dev.getmypen.gov.bc.ca/assets/index-CgwTGcsT.js)

View the [following link](https://github.com/bcgov/EDUC-STUDENT-PROFILE/actions/runs/8820170265) to download the report.
RunnerID:8820170265

Start with the linked GitHub Actions run 8820170265 and its OWASP ZAP report, then inspect how the JavaScript frontend is deployed at the listed development site. The issue is complete only when the reported security findings are reviewed, addressed or explicitly accepted, and a follow-up scan confirms the result.

Written by the indexing model from the issue text.