OWASP ZAP Portal Scan Results

- Site: [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Sub Resource Integrity Attribute Missing** [90003] total: 4:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Cookie with SameSite Attribute None** [10054] total: 1:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 9:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 1:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/main.45eed540527e64c4.js](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/main.45eed540527e64c4.js)
- **Modern Web Application** [10109] total: 4:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Session Management Response Identified** [10112] total: 3:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- **Storable but Non-Cacheable Content** [10049] total: 11:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/env.js](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/env.js)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/snowplow.js](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/snowplow.js)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/favicon.ico](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/favicon.ico)
- ..

**Ignored Alerts**
- **CSP: Failure to Define Directive with No Fallback** [10055] total: 4:
- **CSP: style-src unsafe-inline** [10055] total: 4:
- **Dangerous JS Functions** [10110] total: 1:
- **Re-examine Cache-control Directives** [10015] total: 2:

View the [following link](https://github.com/bcgov/alcs/actions/runs/15369587978) to download the report.
RunnerID:15369587978

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start by downloading the ZAP report from the linked GitHub Actions run and review the six new alerts, including missing SRI, SameSite cookies, site isolation, and cacheability. Identify the affected portal responses or assets and define the remediation scope; done means the applicable alerts are addressed and a subsequent scan verifies the results.

Written by the indexing model from the issue text.