ZAP Security Report: bcbox

- Site: [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
**New Alerts**
- **CORS Misconfiguration** [40040] total: 9:
- [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css](https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css)
- ..
- **CSP: Wildcard Directive** [10055] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **CSP: style-src unsafe-inline** [10055] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Proxy Disclosure** [40025] total: 9:
- [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css](https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 1:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Permissions Policy Header Not Set** [10063] total: 4:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js](https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js)
- **Cookie Slack Detector** [90027] total: 9:
- [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css](https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 1:
- [https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js](https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js)
- **Modern Web Application** [10109] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Non-Storable Content** [10049] total: 2:
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- [https://bcbox.nrs.gov.bc.ca/sitemap.xml](https://bcbox.nrs.gov.bc.ca/sitemap.xml)
- **Re-examine Cache-control Directives** [10015] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Session Management Response Identified** [10112] total: 1:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- **Storable but Non-Cacheable Content** [10049] total: 6:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css](https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css)
- [https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js](https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js)
- ..
- **User Agent Fuzzer** [10104] total: 36:
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- ..

View the [following link](https://github.com/bcgov/bcbox/actions/runs/17886574736) to download the report.
RunnerID:17886574736

---
[ZAP by Checkmarx](https://checkmarx.com/)

Use the ZAP report from GitHub Actions run 17886574736 as the starting point, then inspect the deployed bcbox responses for the listed headers, cookies, cache behavior, and proxy disclosure. Done means the applicable findings are addressed and a follow-up scan confirms the report no longer raises them.

Written by the indexing model from the issue text.