ZAP Security Report: backend
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
- Site: [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 4:
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/api](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Permissions Policy Header Not Set** [10063] total: 4:
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/api](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Strict-Transport-Security Header Not Set** [10035] total: 4:
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/api](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 4:
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/api](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://ipm-platform-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
View the [following link](https://github.com/bcgov/ipm-platform/actions/runs/17174689288) to download the report.
RunnerID:17174689288
---
[ZAP by Checkmarx](https://checkmarx.com/)
Contributor guide
Research direction
Start with the linked ZAP report and inspect the responses for /, /api, /robots.txt, and /sitemap.xml. Determine where these responses are configured, then verify that the four reported security findings are resolved on all listed endpoints by rerunning the report.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100