ZAP Full Scan Report

- Site: [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
**New Alerts**
- **CSP: Wildcard Directive** [10055] total: 4:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **CSP: style-src unsafe-inline** [10055] total: 4:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **Proxy Disclosure** [40025] total: 10:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets](https://dev.getmypen.gov.bc.ca/assets)
- [https://dev.getmypen.gov.bc.ca/assets/index-D12_ekje.css](https://dev.getmypen.gov.bc.ca/assets/index-D12_ekje.css)
- [https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js](https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js)
- ..
- **Sub Resource Integrity Attribute Missing** [90003] total: 8:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 2:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- **Deprecated Feature Policy Header Set** [10063] total: 5:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js](https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **Timestamp Disclosure - Unix** [10096] total: 1:
- [https://dev.getmypen.gov.bc.ca/assets/index-D12_ekje.css](https://dev.getmypen.gov.bc.ca/assets/index-D12_ekje.css)
- **Cookie Slack Detector** [90027] total: 10:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets](https://dev.getmypen.gov.bc.ca/assets)
- [https://dev.getmypen.gov.bc.ca/assets/index-D12_ekje.css](https://dev.getmypen.gov.bc.ca/assets/index-D12_ekje.css)
- [https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js](https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 4:
- [https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js](https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js](https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js](https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js)
- [https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js](https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js)
- **Modern Web Application** [10109] total: 4:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 8:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets/index-D12_ekje.css](https://dev.getmypen.gov.bc.ca/assets/index-D12_ekje.css)
- [https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js](https://dev.getmypen.gov.bc.ca/assets/index-DY9n3coS.js)
- [https://dev.getmypen.gov.bc.ca/bcid-apple-touch-icon.png](https://dev.getmypen.gov.bc.ca/bcid-apple-touch-icon.png)
- ..
- **Session Management Response Identified** [10112] total: 3:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)

View the [following link](https://github.com/bcgov/EDUC-STUDENT-PROFILE/actions/runs/10412068539) to download the report.
RunnerID:10412068539

Start with the OWASP ZAP report linked from GitHub Actions run 10412068539 and review each alert against the deployed frontend at dev.getmypen.gov.bc.ca. Identify the relevant application or deployment configuration files, define which findings require remediation, and rerun the full scan to confirm the agreed alerts are resolved.

Written by the indexing model from the issue text.