ZAP Scan - https://dev-chwf.apps.gold.devops.gov.bc.ca

- Site: [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
**New Alerts**
- **CSP: Failure to Define Directive with No Fallback** [10055] total: 2:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/robots.txt](https://dev-chwf.apps.gold.devops.gov.bc.ca/robots.txt)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/sitemap.xml](https://dev-chwf.apps.gold.devops.gov.bc.ca/sitemap.xml)
- **Content Security Policy (CSP) Header Not Set** [10038] total: 2:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- **Missing Anti-clickjacking Header** [10020] total: 2:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- **Proxy Disclosure** [40025] total: 5:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/BaseLayout-mLarJ6Ix.css](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/BaseLayout-mLarJ6Ix.css)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/CalendarDate-D0we9_wB.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/CalendarDate-D0we9_wB.js)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/CanvasRunWorkflowButton-MqoOLOO1.css](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/CanvasRunWorkflowButton-MqoOLOO1.css)
- **Sub Resource Integrity Attribute Missing** [90003] total: 1:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/index-DnfrcC-y.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/index-DnfrcC-y.js)
- **Cross-Origin-Embedder-Policy Header Missing or Invalid** [90004] total: 2:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- **Cross-Origin-Opener-Policy Header Missing or Invalid** [90004] total: 2:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- **Cross-Origin-Resource-Policy Header Missing or Invalid** [90004] total: 5:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/_plugin-vue_export-helper-CSQczWqg.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/_plugin-vue_export-helper-CSQczWqg.js)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/favicon.ico](https://dev-chwf.apps.gold.devops.gov.bc.ca/favicon.ico)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/static/prefers-color-scheme.css](https://dev-chwf.apps.gold.devops.gov.bc.ca/static/prefers-color-scheme.css)
- **Permissions Policy Header Not Set** [10063] total: 5:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/_plugin-vue_export-helper-CSQczWqg.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/_plugin-vue_export-helper-CSQczWqg.js)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/robots.txt](https://dev-chwf.apps.gold.devops.gov.bc.ca/robots.txt)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/sitemap.xml](https://dev-chwf.apps.gold.devops.gov.bc.ca/sitemap.xml)
- **Private IP Disclosure** [2] total: 1:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/workflows.store-g4ndHFPB.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/workflows.store-g4ndHFPB.js)
- **Strict-Transport-Security Header Not Set** [10035] total: 5:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/favicon.ico](https://dev-chwf.apps.gold.devops.gov.bc.ca/favicon.ico)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/robots.txt](https://dev-chwf.apps.gold.devops.gov.bc.ca/robots.txt)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/sitemap.xml](https://dev-chwf.apps.gold.devops.gov.bc.ca/sitemap.xml)
- **Timestamp Disclosure - Unix** [10096] total: 5:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/RunData-CBt71GZd.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/RunData-CBt71GZd.js)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/RunData-CBt71GZd.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/RunData-CBt71GZd.js)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/constants-DhfXuOB5.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/constants-DhfXuOB5.js)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/constants-DhfXuOB5.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/constants-DhfXuOB5.js)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/constants-DhfXuOB5.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/constants-DhfXuOB5.js)
- **X-Content-Type-Options Header Missing** [10021] total: 5:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/_plugin-vue_export-helper-CSQczWqg.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/_plugin-vue_export-helper-CSQczWqg.js)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/favicon.ico](https://dev-chwf.apps.gold.devops.gov.bc.ca/favicon.ico)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/static/prefers-color-scheme.css](https://dev-chwf.apps.gold.devops.gov.bc.ca/static/prefers-color-scheme.css)
- **Information Disclosure - Suspicious Comments** [10027] total: 2:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/oidc-frontend-hook.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/oidc-frontend-hook.js)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/workflows.store-g4ndHFPB.js](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets/workflows.store-g4ndHFPB.js)
- **Modern Web Application** [10109] total: 2:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- **Non-Storable Content** [10049] total: 1:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- **Re-examine Cache-control Directives** [10015] total: 2:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- **Storable and Cacheable Content** [10049] total: 5:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca](https://dev-chwf.apps.gold.devops.gov.bc.ca)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/favicon.ico](https://dev-chwf.apps.gold.devops.gov.bc.ca/favicon.ico)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/robots.txt](https://dev-chwf.apps.gold.devops.gov.bc.ca/robots.txt)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/sitemap.xml](https://dev-chwf.apps.gold.devops.gov.bc.ca/sitemap.xml)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/static/prefers-color-scheme.css](https://dev-chwf.apps.gold.devops.gov.bc.ca/static/prefers-color-scheme.css)
- **User Agent Fuzzer** [10104] total: 5:
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/](https://dev-chwf.apps.gold.devops.gov.bc.ca/)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets)
- [https://dev-chwf.apps.gold.devops.gov.bc.ca/assets](https://dev-chwf.apps.gold.devops.gov.bc.ca/assets)

View the [following link](https://github.com/bcgov/common-hosted-workflow/actions/runs/28138823345) to download the report.
RunnerID:28138823345

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the ZAP report linked from Actions run 28138823345 and trace the listed response headers and generated assets back to the application configuration. Determine acceptance criteria for each new alert, then rerun the scan and confirm the reported findings are resolved or explicitly assessed.

Written by the indexing model from the issue text.