ZAP Scan Report

- Site: [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com)
**New Alerts**
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api)
- **Unexpected Content-Type was returned** [100001] total: 3:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/latest/meta-data/](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/latest/meta-data/)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?aaa=bbb](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?aaa=bbb)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?class.module.classLoader.DefaultAssertionStatus=nonsense](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com?class.module.classLoader.DefaultAssertionStatus=nonsense)
- **A Client Error response code was returned by the server** [100000] total: 62:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/._darcs](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/._darcs)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.bzr](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.bzr)
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.DS_Store](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/.DS_Store)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api](https://xa6gjgmu8f.execute-api.ca-central-1.amazonaws.com/api)

View the [following link](https://github.com/bcgov/bcparks-ar-api/actions/runs/8099136643) to download the report.
RunnerID:8099136643

Start with the ZAP report from GitHub Actions run 8099136643 and review the listed API endpoints and alerts, including the missing Strict-Transport-Security header. Determine which findings are actionable for the API and validate the changes by rerunning the scan; done means the relevant alerts are resolved or documented as expected behavior.

Written by the indexing model from the issue text.