ZAP Security Report: bcbox

- Site: [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
**New Alerts**
- **CORS Misconfiguration** [40040] total: 5:
- [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/favicon.ico](https://bcbox.nrs.gov.bc.ca/favicon.ico)
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- **CSP: Wildcard Directive** [10055] total: 2:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **CSP: style-src unsafe-inline** [10055] total: 2:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Proxy Disclosure** [40025] total: 5:
- [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js](https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js)
- **Cookie with SameSite Attribute None** [10054] total: 1:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 2:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Permissions Policy Header Not Set** [10063] total: 3:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js](https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js)
- **Cookie Slack Detector** [90027] total: 5:
- [https://bcbox.nrs.gov.bc.ca](https://bcbox.nrs.gov.bc.ca)
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt](https://bcbox.nrs.gov.bc.ca/?r=%2Frobots.txt)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- **Information Disclosure - Suspicious Comments** [10027] total: 1:
- [https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js](https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js)
- **Modern Web Application** [10109] total: 2:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Non-Storable Content** [10049] total: 2:
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- [https://bcbox.nrs.gov.bc.ca/sitemap.xml](https://bcbox.nrs.gov.bc.ca/sitemap.xml)
- **Re-examine Cache-control Directives** [10015] total: 2:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- **Session Management Response Identified** [10112] total: 1:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- **Storable but Non-Cacheable Content** [10049] total: 5:
- [https://bcbox.nrs.gov.bc.ca/](https://bcbox.nrs.gov.bc.ca/)
- [https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml](https://bcbox.nrs.gov.bc.ca/?r=%2Fsitemap.xml)
- [https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css](https://bcbox.nrs.gov.bc.ca/assets/index-BwP-5sSb.css)
- [https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js](https://bcbox.nrs.gov.bc.ca/assets/index-ULR3n18n.js)
- [https://bcbox.nrs.gov.bc.ca/favicon.ico](https://bcbox.nrs.gov.bc.ca/favicon.ico)
- **User Agent Fuzzer** [10104] total: 5:
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/assets](https://bcbox.nrs.gov.bc.ca/assets)
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)
- [https://bcbox.nrs.gov.bc.ca/robots.txt](https://bcbox.nrs.gov.bc.ca/robots.txt)

View the [following link](https://github.com/bcgov/bcbox/actions/runs/20402090210) to download the report.
RunnerID:20402090210

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start by reviewing the linked ZAP report and the listed responses for bcbox.nrs.gov.bc.ca, including /assets/index-ULR3n18n.js, robots.txt, and sitemap.xml. Group the reported alerts by affected response, confirm which findings are actionable, and rerun the security scan after remediation to verify the selected alerts are resolved.

Written by the indexing model from the issue text.