ZAP: Backend

- Site: [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 4:
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Permissions Policy Header Not Set** [10063] total: 4:
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Strict-Transport-Security Header Not Set** [10035] total: 4:
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 4:
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Sec-Fetch-Dest Header is Missing** [90005] total: 4:
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Sec-Fetch-Mode Header is Missing** [90005] total: 4:
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Sec-Fetch-Site Header is Missing** [90005] total: 4:
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Sec-Fetch-User Header is Missing** [90005] total: 4:
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/api)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qs1-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)

View the [following link](https://github.com/bcgov/qs1/actions/runs/30156270676) to download the report.
RunnerID:30156270676

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the ZAP report linked in the issue and inspect the deployment or backend configuration responsible for responses from the listed site, /api, robots.txt, and sitemap.xml endpoints. Verify which reported headers are expected, update the responsible configuration, and rerun ZAP to confirm the findings are resolved.

Written by the indexing model from the issue text.