OWASP ZAP Frontend Scan Results
- Dominant language
- TypeScript
- Stars
- 10
- Forks
- 0
- Avg merge
- 20h 8m
- Merged PRs (30d)
- 30
Description
- Site: [https://alcs-dev.apps.silver.devops.gov.bc.ca](https://alcs-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Cookie with SameSite Attribute None** [10054] total: 2:
- [https://alcs-dev.apps.silver.devops.gov.bc.ca](https://alcs-dev.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- **Cross-Origin-Embedder-Policy Header Missing or Invalid** [90004] total: 4:
- [https://alcs-dev.apps.silver.devops.gov.bc.ca](https://alcs-dev.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/](https://alcs-dev.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Cross-Origin-Opener-Policy Header Missing or Invalid** [90004] total: 4:
- [https://alcs-dev.apps.silver.devops.gov.bc.ca](https://alcs-dev.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/](https://alcs-dev.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Cross-Origin-Resource-Policy Header Missing or Invalid** [90004] total: 5:
- [https://alcs-dev.apps.silver.devops.gov.bc.ca](https://alcs-dev.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/](https://alcs-dev.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/favicon.ico](https://alcs-dev.apps.silver.devops.gov.bc.ca/favicon.ico)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Modern Web Application** [10109] total: 4:
- [https://alcs-dev.apps.silver.devops.gov.bc.ca](https://alcs-dev.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/](https://alcs-dev.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Session Management Response Identified** [10112] total: 2:
- [https://alcs-dev.apps.silver.devops.gov.bc.ca](https://alcs-dev.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- **Storable but Non-Cacheable Content** [10049] total: 5:
- [https://alcs-dev.apps.silver.devops.gov.bc.ca](https://alcs-dev.apps.silver.devops.gov.bc.ca)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/](https://alcs-dev.apps.silver.devops.gov.bc.ca/)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/favicon.ico](https://alcs-dev.apps.silver.devops.gov.bc.ca/favicon.ico)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://alcs-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://alcs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
**Ignored Alerts**
- **CSP: Failure to Define Directive with No Fallback** [10055] total: 4:
- **CSP: style-src unsafe-inline** [10055] total: 4:
- **Dangerous JS Functions** [10110] total: 1:
- **Re-examine Cache-control Directives** [10015] total: 4:
View the [following link](https://github.com/bcgov/alcs/actions/runs/34004027776) to download the report.
RunnerID:34004027776
---
[ZAP by Checkmarx](https://checkmarx.com/)
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the linked GitHub Actions run and download the OWASP ZAP report. The issue names no source files, tests, or application entry points, so trace the reported frontend responses before deciding where each alert belongs. Done should include a follow-up scan showing that the intended new alerts are resolved or explicitly reviewed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100