ZAP Security Report: bcbox

- Site: [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
**New Alerts**
- **CORS Misconfiguration** [40040] total: 8:
- [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets/index-CpvD3aEJ.css](https://bcbox.nrs.gov.bc.ca/assets/index-CpvD3aEJ.css)
- ..
- **CSP: Wildcard Directive** [10055] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **CSP: style-src unsafe-inline** [10055] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Proxy Disclosure** [40025] total: 8:
- [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets/index-CpvD3aEJ.css](https://bcbox.nrs.gov.bc.ca/assets/index-CpvD3aEJ.css)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 2:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Permissions Policy Header Not Set** [10063] total: 4:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets/index-Cr280iJb.js](https://bcbox.nrs.gov.bc.ca/assets/index-Cr280iJb.js)
- **Cookie Slack Detector** [90027] total: 8:
- [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets/index-CpvD3aEJ.css](https://bcbox.nrs.gov.bc.ca/assets/index-CpvD3aEJ.css)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 1:
- [https://bcbox.nrs.gov.bc.ca/assets/index-Cr280iJb.js](https://bcbox.nrs.gov.bc.ca/assets/index-Cr280iJb.js)
- **Modern Web Application** [10109] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Non-Storable Content** [10049] total: 2:
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- [https://bcbox.nrs.gov.bc.ca/sitemap.xml](https://bcbox.nrs.gov.bc.ca/sitemap.xml)
- **Re-examine Cache-control Directives** [10015] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Session Management Response Identified** [10112] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- **Storable but Non-Cacheable Content** [10049] total: 6:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets/index-CpvD3aEJ.css](https://bcbox.nrs.gov.bc.ca/assets/index-CpvD3aEJ.css)
- [https://bcbox.nrs.gov.bc.ca/assets/index-Cr280iJb.js](https://bcbox.nrs.gov.bc.ca/assets/index-Cr280iJb.js)
- ..
- **User Agent Fuzzer** [10104] total: 24:
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- ..

View the [following link](https://github.com/bcgov/bcbox/actions/runs/15721971030) to download the report.
RunnerID:15721971030

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start by downloading the ZAP report from the linked GitHub Actions run and reviewing the listed response and header findings for the deployed site. Done would require identifying actionable findings and confirming the resulting security responses, but the issue names no source files or tests.

Written by the indexing model from the issue text.