ZAP Full Scan Report

- Site: [https://dev.ehpr.freshworks.club](https://dev.ehpr.freshworks.club)
**New Alerts**
- **Anti-CSRF Tokens Check** [20012] total: 1:
- [https://dev.ehpr.freshworks.club/submission/1](https://dev.ehpr.freshworks.club/submission/1)
- **Application Error Disclosure** [90022] total: 1:
- [https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_error-c6bb6a48957c399c.js](https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_error-c6bb6a48957c399c.js)
- **CSP: Wildcard Directive** [10055] total: 2:
- [https://dev.ehpr.freshworks.club/](https://dev.ehpr.freshworks.club/)
- [https://dev.ehpr.freshworks.club/submission/1](https://dev.ehpr.freshworks.club/submission/1)
- **CSP: script-src unsafe-inline** [10055] total: 2:
- [https://dev.ehpr.freshworks.club/](https://dev.ehpr.freshworks.club/)
- [https://dev.ehpr.freshworks.club/submission/1](https://dev.ehpr.freshworks.club/submission/1)
- **CSP: style-src unsafe-inline** [10055] total: 2:
- [https://dev.ehpr.freshworks.club/](https://dev.ehpr.freshworks.club/)
- [https://dev.ehpr.freshworks.club/submission/1](https://dev.ehpr.freshworks.club/submission/1)
- **Content Security Policy (CSP) Header Not Set** [10038] total: 2:
- [https://dev.ehpr.freshworks.club/robots.txt](https://dev.ehpr.freshworks.club/robots.txt)
- [https://dev.ehpr.freshworks.club/sitemap.xml](https://dev.ehpr.freshworks.club/sitemap.xml)
- **Proxy Disclosure** [40025] total: 28:
- [https://dev.ehpr.freshworks.club](https://dev.ehpr.freshworks.club)
- [https://dev.ehpr.freshworks.club/](https://dev.ehpr.freshworks.club/)
- [https://dev.ehpr.freshworks.club/_next](https://dev.ehpr.freshworks.club/_next)
- [https://dev.ehpr.freshworks.club/_next/static](https://dev.ehpr.freshworks.club/_next/static)
- [https://dev.ehpr.freshworks.club/_next/static/chunks](https://dev.ehpr.freshworks.club/_next/static/chunks)
- ..
- **Absence of Anti-CSRF Tokens** [10202] total: 1:
- [https://dev.ehpr.freshworks.club/submission/1](https://dev.ehpr.freshworks.club/submission/1)
- **Incomplete or No Cache-control Header Set** [10015] total: 2:
- [https://dev.ehpr.freshworks.club/](https://dev.ehpr.freshworks.club/)
- [https://dev.ehpr.freshworks.club/submission/1](https://dev.ehpr.freshworks.club/submission/1)
- **Server Leaks Version Information via "Server" HTTP Response Header Field** [10036] total: 12:
- [https://dev.ehpr.freshworks.club/](https://dev.ehpr.freshworks.club/)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/main-a6668b91e7e3748f.js](https://dev.ehpr.freshworks.club/_next/static/chunks/main-a6668b91e7e3748f.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_app-4fc6c2b8311cf46a.js](https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_app-4fc6c2b8311cf46a.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/pages/index-d9a1454ed7a3bba6.js](https://dev.ehpr.freshworks.club/_next/static/chunks/pages/index-d9a1454ed7a3bba6.js)
- ..
- **Strict-Transport-Security Header Not Set** [10035] total: 12:
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/main-a6668b91e7e3748f.js](https://dev.ehpr.freshworks.club/_next/static/chunks/main-a6668b91e7e3748f.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_app-4fc6c2b8311cf46a.js](https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_app-4fc6c2b8311cf46a.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/pages/index-d9a1454ed7a3bba6.js](https://dev.ehpr.freshworks.club/_next/static/chunks/pages/index-d9a1454ed7a3bba6.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/polyfills-5cd94c89d3acac5f.js](https://dev.ehpr.freshworks.club/_next/static/chunks/polyfills-5cd94c89d3acac5f.js)
- ..
- **Timestamp Disclosure - Unix** [10096] total: 12:
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- ..
- **X-Content-Type-Options Header Missing** [10021] total: 12:
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/main-a6668b91e7e3748f.js](https://dev.ehpr.freshworks.club/_next/static/chunks/main-a6668b91e7e3748f.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_app-4fc6c2b8311cf46a.js](https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_app-4fc6c2b8311cf46a.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_error-c6bb6a48957c399c.js](https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_error-c6bb6a48957c399c.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/pages/index-d9a1454ed7a3bba6.js](https://dev.ehpr.freshworks.club/_next/static/chunks/pages/index-d9a1454ed7a3bba6.js)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 8:
- [https://dev.ehpr.freshworks.club/](https://dev.ehpr.freshworks.club/)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/main-a6668b91e7e3748f.js](https://dev.ehpr.freshworks.club/_next/static/chunks/main-a6668b91e7e3748f.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_app-4fc6c2b8311cf46a.js](https://dev.ehpr.freshworks.club/_next/static/chunks/pages/_app-4fc6c2b8311cf46a.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/polyfills-5cd94c89d3acac5f.js](https://dev.ehpr.freshworks.club/_next/static/chunks/polyfills-5cd94c89d3acac5f.js)
- ..
- **Modern Web Application** [10109] total: 6:
- [https://dev.ehpr.freshworks.club/](https://dev.ehpr.freshworks.club/)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js](https://dev.ehpr.freshworks.club/_next/static/chunks/framework-c4190dd27fdc6a34.js)
- [https://dev.ehpr.freshworks.club/_next/static/chunks/polyfills-5cd94c89d3acac5f.js](https://dev.ehpr.freshworks.club/_next/static/chunks/polyfills-5cd94c89d3acac5f.js)
- [https://dev.ehpr.freshworks.club/robots.txt](https://dev.ehpr.freshworks.club/robots.txt)
- [https://dev.ehpr.freshworks.club/sitemap.xml](https://dev.ehpr.freshworks.club/sitemap.xml)
- ..

View the [following link](https://github.com/bcgov/ehpr2/actions/runs/1679142600) to download the report.
RunnerID:1679142600

Start with the ZAP report from actions/runs/1679142600 and reproduce the listed findings against the site root, /submission/1, /robots.txt, and /sitemap.xml. No source file or test is named, so locate the application and deployment configuration responsible for these responses. Done means each alert is remediated or explicitly assessed and documented.

Written by the indexing model from the issue text.