ZAP: backend

- Site: [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 4:
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Permissions Policy Header Not Set** [10063] total: 4:
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Strict-Transport-Security Header Not Set** [10035] total: 4:
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 4:
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Sec-Fetch-Dest Header is Missing** [90005] total: 3:
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt)
- **Sec-Fetch-Mode Header is Missing** [90005] total: 3:
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt)
- **Sec-Fetch-Site Header is Missing** [90005] total: 3:
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt)
- **Sec-Fetch-User Header is Missing** [90005] total: 3:
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/)
- [https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt](https://nr-test-openshift-temp-test-backend.apps.silver.devops.gov.bc.ca/robots.txt)

View the [following link](https://github.com/bcgov/nr-test-openshift-temp/actions/runs/17174688880) to download the report.
RunnerID:17174688880

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Download the ZAP report from the linked GitHub Actions run and inspect the backend responses for the listed missing security headers. Identify where the TypeScript backend configures responses for the root, robots.txt, and sitemap.xml endpoints. Done means the relevant ZAP alerts no longer appear in a rerun.

Written by the indexing model from the issue text.