OWASP ZAP API Scan Results

- Site: [https://alcs-dev-api.apps.silver.devops.gov.bc.ca](https://alcs-dev-api.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **CSP: Wildcard Directive** [10055] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- **CSP: script-src unsafe-inline** [10055] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- **CSP: style-src unsafe-inline** [10055] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- **Cookie with SameSite Attribute None** [10054] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- **Unexpected Content-Type was returned** [100001] total: 6:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs/](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs/)
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/metadata/instance](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/metadata/instance)
- ..
- **Modern Web Application** [10109] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- **Re-examine Cache-control Directives** [10015] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- **Session Management Response Identified** [10112] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)
- **Storable and Cacheable Content** [10049] total: 1:
- [https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs](https://alcs-dev-api.apps.silver.devops.gov.bc.ca/docs)

View the [following link](https://github.com/bcgov/alcs/actions/runs/15369587978) to download the report.
RunnerID:15369587978

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the linked OWASP ZAP report and review the findings for the /docs and metadata endpoints. No source file or test is named, so locate the API and documentation entry points before investigating. Done means addressing the applicable alerts and rerunning the scan to confirm the findings are resolved.

Written by the indexing model from the issue text.