OWASP ZAP Portal Scan Results

- Site: [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Cookie with SameSite Attribute None** [10054] total: 1:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- **Cross-Origin-Embedder-Policy Header Missing or Invalid** [90004] total: 4:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Cross-Origin-Opener-Policy Header Missing or Invalid** [90004] total: 4:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Cross-Origin-Resource-Policy Header Missing or Invalid** [90004] total: 5:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/env.js](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/env.js)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Modern Web Application** [10109] total: 4:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Session Management Response Identified** [10112] total: 2:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- **Storable but Non-Cacheable Content** [10049] total: 5:
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/env.js](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/assets/env.js)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev-portal.apps.silver.devops.gov.bc.ca/sitemap.xml)

**Ignored Alerts**
- **CSP: Failure to Define Directive with No Fallback** [10055] total: 4:
- **CSP: style-src unsafe-inline** [10055] total: 4:
- **Dangerous JS Functions** [10110] total: 1:
- **Re-examine Cache-control Directives** [10015] total: 4:

View the [following link](https://github.com/bcgov/alcs/actions/runs/27079616458) to download the report.
RunnerID:27079616458

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the linked GitHub Actions run and download the OWASP ZAP report; the issue names affected portal URLs and new alerts but no repository files. Trace how those responses are produced, determine which findings are actionable, and rerun the scan to confirm the selected alerts are resolved or documented.

Written by the indexing model from the issue text.