OWASP ZAP Portal Scan Results

- Site: [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Cookie with SameSite Attribute None** [10054] total: 1:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 9:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 1:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/main.45eed540527e64c4.js](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/main.45eed540527e64c4.js)
- **Modern Web Application** [10109] total: 4:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Session Management Response Identified** [10112] total: 2:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- **Storable but Non-Cacheable Content** [10049] total: 11:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/env.js](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/env.js)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/snowplow.js](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/snowplow.js)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/favicon.ico](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/favicon.ico)
- ..

**Ignored Alerts**
- **CSP: Failure to Define Directive with No Fallback** [10055] total: 4:
- **CSP: style-src unsafe-inline** [10055] total: 4:
- **Dangerous JS Functions** [10110] total: 1:
- **Re-examine Cache-control Directives** [10015] total: 4:

View the [following link](https://github.com/bcgov/alcs/actions/runs/17887314668) to download the report.
RunnerID:17887314668

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the OWASP ZAP report from GitHub Actions run 17887314668 and review each New Alert against the portal URLs listed. Determine which findings require changes and verify that the scan no longer reports them; the issue does not name source files, tests, or an acceptance decision.

Written by the indexing model from the issue text.