ZAP Scan Baseline Report

- Site: [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 2:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Cookie with SameSite Attribute None** [10054] total: 2:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- **Dangerous JS Functions** [10110] total: 1:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js)
- **Permissions Policy Header Not Set** [10063] total: 5:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/config/features.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/config/features.js)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/tracker.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/tracker.js)
- **Strict-Transport-Security Header Not Set** [10035] total: 10:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/favicon.ico](https://itvr-dev.apps.silver.devops.gov.bc.ca/favicon.ico)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/logo192.png](https://itvr-dev.apps.silver.devops.gov.bc.ca/logo192.png)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/manifest.json](https://itvr-dev.apps.silver.devops.gov.bc.ca/manifest.json)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- ..
- **Timestamp Disclosure - Unix** [10096] total: 19:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js)
- ..
- **X-Content-Type-Options Header Missing** [10021] total: 10:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/favicon.ico](https://itvr-dev.apps.silver.devops.gov.bc.ca/favicon.ico)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/logo192.png](https://itvr-dev.apps.silver.devops.gov.bc.ca/logo192.png)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/manifest.json](https://itvr-dev.apps.silver.devops.gov.bc.ca/manifest.json)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 1:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js)
- **Modern Web Application** [10109] total: 2:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 2:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- **Re-examine Cache-control Directives** [10015] total: 2:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/manifest.json](https://itvr-dev.apps.silver.devops.gov.bc.ca/manifest.json)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Session Management Response Identified** [10112] total: 3:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt](https://itvr-dev.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js](https://itvr-dev.apps.silver.devops.gov.bc.ca/static/js/main.6890e49e.js)
- **Storable and Cacheable Content** [10049] total: 9:
- [https://itvr-dev.apps.silver.devops.gov.bc.ca](https://itvr-dev.apps.silver.devops.gov.bc.ca)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/favicon.ico](https://itvr-dev.apps.silver.devops.gov.bc.ca/favicon.ico)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/logo192.png](https://itvr-dev.apps.silver.devops.gov.bc.ca/logo192.png)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/manifest.json](https://itvr-dev.apps.silver.devops.gov.bc.ca/manifest.json)
- [https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml](https://itvr-dev.apps.silver.devops.gov.bc.ca/sitemap.xml)
- ..

View the [following link](https://github.com/bcgov/itvr/actions/runs/8667930758) to download the report.
RunnerID:8667930758

Start with the ZAP report linked from the issue (RunnerID 8667930758) and review the listed alerts across the application root, sitemap.xml, robots.txt, static JavaScript, and other assets. The scope is complete when the relevant findings have an agreed remediation and a subsequent ZAP scan confirms the intended results.

Written by the indexing model from the issue text.