ZAP Scan Report

- Site: [https://d3ekj6rc493dgk.cloudfront.net](https://d3ekj6rc493dgk.cloudfront.net)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 10:
- [https://d3ekj6rc493dgk.cloudfront.net/](https://d3ekj6rc493dgk.cloudfront.net/)
- [https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico](https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico)
- [https://d3ekj6rc493dgk.cloudfront.net/env.js](https://d3ekj6rc493dgk.cloudfront.net/env.js)
- [https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js](https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js)
- [https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js](https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js)
- ..
- **Missing Anti-clickjacking Header** [10020] total: 10:
- [https://d3ekj6rc493dgk.cloudfront.net/](https://d3ekj6rc493dgk.cloudfront.net/)
- [https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico](https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico)
- [https://d3ekj6rc493dgk.cloudfront.net/env.js](https://d3ekj6rc493dgk.cloudfront.net/env.js)
- [https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js](https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js)
- [https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js](https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js)
- ..
- **Permissions Policy Header Not Set** [10063] total: 10:
- [https://d3ekj6rc493dgk.cloudfront.net/](https://d3ekj6rc493dgk.cloudfront.net/)
- [https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico](https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico)
- [https://d3ekj6rc493dgk.cloudfront.net/env.js](https://d3ekj6rc493dgk.cloudfront.net/env.js)
- [https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js](https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js)
- [https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js](https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js)
- ..
- **Server Leaks Version Information via "Server" HTTP Response Header Field** [10036] total: 10:
- [https://d3ekj6rc493dgk.cloudfront.net/](https://d3ekj6rc493dgk.cloudfront.net/)
- [https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico](https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico)
- [https://d3ekj6rc493dgk.cloudfront.net/env.js](https://d3ekj6rc493dgk.cloudfront.net/env.js)
- [https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js](https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js)
- [https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js](https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js)
- ..
- **Strict-Transport-Security Header Not Set** [10035] total: 10:
- [https://d3ekj6rc493dgk.cloudfront.net/](https://d3ekj6rc493dgk.cloudfront.net/)
- [https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico](https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico)
- [https://d3ekj6rc493dgk.cloudfront.net/env.js](https://d3ekj6rc493dgk.cloudfront.net/env.js)
- [https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js](https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js)
- [https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js](https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js)
- ..
- **X-Content-Type-Options Header Missing** [10021] total: 10:
- [https://d3ekj6rc493dgk.cloudfront.net/](https://d3ekj6rc493dgk.cloudfront.net/)
- [https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico](https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico)
- [https://d3ekj6rc493dgk.cloudfront.net/env.js](https://d3ekj6rc493dgk.cloudfront.net/env.js)
- [https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js](https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js)
- [https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js](https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 5:
- [https://d3ekj6rc493dgk.cloudfront.net/env.js](https://d3ekj6rc493dgk.cloudfront.net/env.js)
- [https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js](https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js)
- [https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js](https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js)
- [https://d3ekj6rc493dgk.cloudfront.net/runtime.4eed39c3ea370e2d.js](https://d3ekj6rc493dgk.cloudfront.net/runtime.4eed39c3ea370e2d.js)
- [https://d3ekj6rc493dgk.cloudfront.net/scripts.81f609e96391afa1.js](https://d3ekj6rc493dgk.cloudfront.net/scripts.81f609e96391afa1.js)
- **Modern Web Application** [10109] total: 10:
- [https://d3ekj6rc493dgk.cloudfront.net/](https://d3ekj6rc493dgk.cloudfront.net/)
- [https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico](https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico)
- [https://d3ekj6rc493dgk.cloudfront.net/env.js](https://d3ekj6rc493dgk.cloudfront.net/env.js)
- [https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js](https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js)
- [https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js](https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js)
- ..
- **Re-examine Cache-control Directives** [10015] total: 3:
- [https://d3ekj6rc493dgk.cloudfront.net/](https://d3ekj6rc493dgk.cloudfront.net/)
- [https://d3ekj6rc493dgk.cloudfront.net/robots.txt](https://d3ekj6rc493dgk.cloudfront.net/robots.txt)
- [https://d3ekj6rc493dgk.cloudfront.net/sitemap.xml](https://d3ekj6rc493dgk.cloudfront.net/sitemap.xml)
- **Storable and Cacheable Content** [10049] total: 10:
- [https://d3ekj6rc493dgk.cloudfront.net/](https://d3ekj6rc493dgk.cloudfront.net/)
- [https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico](https://d3ekj6rc493dgk.cloudfront.net/assets/images/favicon_bcid.ico)
- [https://d3ekj6rc493dgk.cloudfront.net/env.js](https://d3ekj6rc493dgk.cloudfront.net/env.js)
- [https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js](https://d3ekj6rc493dgk.cloudfront.net/main.6bf5c546d271f7a9.js)
- [https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js](https://d3ekj6rc493dgk.cloudfront.net/polyfills.fef7da543b68abac.js)
- ..

View the [following link](https://github.com/bcgov/bcparks-ar-admin/actions/runs/5316047442) to download the report.
RunnerID:5316047442

Start with the ZAP report from GitHub Actions run 5316047442 and inspect how the deployed CloudFront site is configured to return response headers. Determine which reported findings are actionable, then verify the deployment no longer reports the intended header and information-disclosure issues in a follow-up scan.

Written by the indexing model from the issue text.