ZAP Scan Report

- Site: [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com)
**New Alerts**
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api)
- **Unexpected Content-Type was returned** [100001] total: 3:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/latest/meta-data/](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/latest/meta-data/)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?aaa=bbb](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?aaa=bbb)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?class.module.classLoader.DefaultAssertionStatus=nonsense](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?class.module.classLoader.DefaultAssertionStatus=nonsense)
- **A Client Error response code was returned by the server** [100000] total: 62:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/._darcs](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/._darcs)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.bzr](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.bzr)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.DS_Store](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.DS_Store)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api)

View the [following link](https://github.com/bcgov/bcparks-ar-api/actions/runs/6003379378) to download the report.
RunnerID:6003379378

Download the ZAP report from the linked GitHub Actions run and review the findings for the deployed API endpoint, especially the missing Strict-Transport-Security header and unexpected content types. Determine which alerts are actionable, define the required remediation, and rerun the scan to confirm the reported issues are addressed.

Written by the indexing model from the issue text.