ZAP Security Report: backend

- Site: [https://common-notify-test.apps.silver.devops.gov.bc.ca](https://common-notify-test.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **CSP: script-src unsafe-inline** [10055] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **CSP: style-src unsafe-inline** [10055] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Cross-Origin-Embedder-Policy Header Missing or Invalid** [90004] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Timestamp Disclosure - Unix** [10096] total: 1:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/assets/index-BGiLfia3.js](https://common-notify-test.apps.silver.devops.gov.bc.ca/assets/index-BGiLfia3.js)
- **Information Disclosure - Suspicious Comments** [10027] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Modern Web Application** [10109] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 5:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/api](https://common-notify-test.apps.silver.devops.gov.bc.ca/api)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/favicon.ico](https://common-notify-test.apps.silver.devops.gov.bc.ca/favicon.ico)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **User Agent Fuzzer** [10104] total: 5:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/api](https://common-notify-test.apps.silver.devops.gov.bc.ca/api)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/api](https://common-notify-test.apps.silver.devops.gov.bc.ca/api)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/api](https://common-notify-test.apps.silver.devops.gov.bc.ca/api)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/api](https://common-notify-test.apps.silver.devops.gov.bc.ca/api)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/api](https://common-notify-test.apps.silver.devops.gov.bc.ca/api)

View the [following link](https://github.com/bcgov/common-notify/actions/runs/28287968878) to download the report.
RunnerID:28287968878

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start by reviewing the linked ZAP report and reproducing its findings against the listed site and /api endpoint. Trace the backend response and header configuration, then determine which alerts are actionable and confirm that the resolved findings no longer appear in a fresh ZAP scan.

Written by the indexing model from the issue text.