ZAP Security Report: frontend

- Site: [https://common-notify-test.apps.silver.devops.gov.bc.ca](https://common-notify-test.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **CSP: script-src unsafe-inline** [10055] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **CSP: style-src unsafe-inline** [10055] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Cross-Origin-Embedder-Policy Header Missing or Invalid** [90004] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Timestamp Disclosure - Unix** [10096] total: 1:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/assets/index-DheutMbc.js](https://common-notify-test.apps.silver.devops.gov.bc.ca/assets/index-DheutMbc.js)
- **Information Disclosure - Suspicious Comments** [10027] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Modern Web Application** [10109] total: 3:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 5:
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/](https://common-notify-test.apps.silver.devops.gov.bc.ca/)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/favicon.ico](https://common-notify-test.apps.silver.devops.gov.bc.ca/favicon.ico)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt](https://common-notify-test.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml](https://common-notify-test.apps.silver.devops.gov.bc.ca/sitemap.xml)
- [https://common-notify-test.apps.silver.devops.gov.bc.ca/static/config.js](https://common-notify-test.apps.silver.devops.gov.bc.ca/static/config.js)

View the [following link](https://github.com/bcgov/common-notify/actions/runs/28704855074) to download the report.
RunnerID:28704855074

---
[ZAP by Checkmarx](https://checkmarx.com/)

Download the ZAP report from the linked GitHub Actions run and review the findings for the frontend site, including the root page, robots.txt, sitemap.xml, favicon.ico, and static/config.js. Start by reproducing the scan and locating the frontend deployment configuration; done means the applicable alerts are addressed or explicitly assessed and the scan results are verified.

Written by the indexing model from the issue text.