ZAP API Scan Report

- Site: [https://mds-permits-test.apps.silver.devops.gov.bc.ca](https://mds-permits-test.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Cookie with SameSite Attribute None** [10054] total: 8:
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json](https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/flow](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/flow)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results/csv?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results/csv?task_id=)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results?task_id=)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/status?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/status?task_id=)
- ..
- **Insufficient Site Isolation Against Spectre Vulnerability** [90004] total: 1:
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json](https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json)
- **Strict-Transport-Security Header Not Set** [10035] total: 8:
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json](https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/flow](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/flow)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results/csv?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results/csv?task_id=)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results?task_id=)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/status?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/status?task_id=)
- ..
- **Unexpected Content-Type was returned** [100001] total: 4:
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://mds-permits-test.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://mds-permits-test.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/metadata/instance](https://mds-permits-test.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://mds-permits-test.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- **X-Content-Type-Options Header Missing** [10021] total: 1:
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json](https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json)
- **Non-Storable Content** [10049] total: 7:
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/flow](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/flow)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results/csv?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results/csv?task_id=)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results?task_id=)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/status?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/status?task_id=)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit/index](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit/index)
- ..
- **Re-examine Cache-control Directives** [10015] total: 1:
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json](https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json)
- **Session Management Response Identified** [10112] total: 8:
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json](https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/flow](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/flow)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results/csv?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results/csv?task_id=)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/results?task_id=)
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/status?task_id=](https://mds-permits-test.apps.silver.devops.gov.bc.ca/permit_conditions/status?task_id=)
- ..
- **Storable and Cacheable Content** [10049] total: 1:
- [https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json](https://mds-permits-test.apps.silver.devops.gov.bc.ca/openapi.json)

View the [following link](https://github.com/bcgov/mds/actions/runs/13420478963) to download the report.
RunnerID:13420478963

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the linked GitHub Actions ZAP report and review each alert against the listed API endpoints, including openapi.json and the permit_conditions routes. Identify the applicable findings and their response or deployment entry points; done means the confirmed issues are remediated or documented as accepted, then the ZAP scan is rerun with no unresolved applicable alerts.

Written by the indexing model from the issue text.