ZAP Full Scan Report

- Site: [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
**New Alerts**
- **CSP: Failure to Define Directive with No Fallback** [10055] total: 4:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **CSP: style-src unsafe-inline** [10055] total: 4:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **Hidden File Found** [40035] total: 4:
- [https://dev.getmypen.gov.bc.ca/._darcs](https://dev.getmypen.gov.bc.ca/._darcs)
- [https://dev.getmypen.gov.bc.ca/.bzr](https://dev.getmypen.gov.bc.ca/.bzr)
- [https://dev.getmypen.gov.bc.ca/.hg](https://dev.getmypen.gov.bc.ca/.hg)
- [https://dev.getmypen.gov.bc.ca/BitKeeper](https://dev.getmypen.gov.bc.ca/BitKeeper)
- **Proxy Disclosure** [40025] total: 10:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets](https://dev.getmypen.gov.bc.ca/assets)
- [https://dev.getmypen.gov.bc.ca/assets/index-CQ1RB3HY.css](https://dev.getmypen.gov.bc.ca/assets/index-CQ1RB3HY.css)
- [https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js](https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js)
- ..
- **Sub Resource Integrity Attribute Missing** [90003] total: 8:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 2:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- **Deprecated Feature Policy Header Set** [10063] total: 5:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js](https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 13:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/bcid-apple-touch-icon.png](https://dev.getmypen.gov.bc.ca/bcid-apple-touch-icon.png)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- ..
- **Cookie Slack Detector** [90027] total: 10:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets](https://dev.getmypen.gov.bc.ca/assets)
- [https://dev.getmypen.gov.bc.ca/assets/index-CQ1RB3HY.css](https://dev.getmypen.gov.bc.ca/assets/index-CQ1RB3HY.css)
- [https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js](https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 1:
- [https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js](https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js)
- **Modern Web Application** [10109] total: 4:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/robots.txt](https://dev.getmypen.gov.bc.ca/robots.txt)
- [https://dev.getmypen.gov.bc.ca/sitemap.xml](https://dev.getmypen.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 8:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)
- [https://dev.getmypen.gov.bc.ca/assets/index-CQ1RB3HY.css](https://dev.getmypen.gov.bc.ca/assets/index-CQ1RB3HY.css)
- [https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js](https://dev.getmypen.gov.bc.ca/assets/index-DeFFk9bJ.js)
- [https://dev.getmypen.gov.bc.ca/bcid-apple-touch-icon.png](https://dev.getmypen.gov.bc.ca/bcid-apple-touch-icon.png)
- ..
- **Session Management Response Identified** [10112] total: 2:
- [https://dev.getmypen.gov.bc.ca](https://dev.getmypen.gov.bc.ca)
- [https://dev.getmypen.gov.bc.ca/](https://dev.getmypen.gov.bc.ca/)

View the [following link](https://github.com/bcgov/EDUC-STUDENT-PROFILE/actions/runs/16526345434) to download the report.
RunnerID:16526345434

---
[ZAP by Checkmarx](https://checkmarx.com/)

Download the ZAP report from the linked GitHub Actions run and review the listed alerts against the dev.getmypen.gov.bc.ca responses. Identify the relevant application or deployment entry points, then verify that each actionable finding is addressed or documented and rerun the full scan to confirm the result.

Written by the indexing model from the issue text.