ZAP Scan Report

- Site: [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com)
**New Alerts**
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api)
- **Unexpected Content-Type was returned** [100001] total: 3:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/latest/meta-data/](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/latest/meta-data/)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?aaa=bbb](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?aaa=bbb)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?class.module.classLoader.DefaultAssertionStatus=nonsense](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?class.module.classLoader.DefaultAssertionStatus=nonsense)
- **A Client Error response code was returned by the server** [100000] total: 62:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/._darcs](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/._darcs)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.bzr](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.bzr)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.DS_Store](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.DS_Store)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api)

View the [following link](https://github.com/bcgov/bcparks-ar-api/actions/runs/7037064843) to download the report.
RunnerID:7037064843

Download the ZAP report from the linked GitHub Actions run and review the findings against the API endpoint. Start by locating the deployment and API configuration, then reproduce the reported responses. Done means each alert is addressed or documented as an accepted finding, with a follow-up scan confirming the result.

Written by the indexing model from the issue text.