ZAP: frontend

- Site: [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 4:
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Permissions Policy Header Not Set** [10063] total: 4:
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Strict-Transport-Security Header Not Set** [10035] total: 4:
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 4:
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Sec-Fetch-Dest Header is Missing** [90005] total: 4:
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Sec-Fetch-Mode Header is Missing** [90005] total: 4:
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Sec-Fetch-Site Header is Missing** [90005] total: 4:
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Sec-Fetch-User Header is Missing** [90005] total: 4:
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://qsos-leaflet-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)

View the [following link](https://github.com/bcgov/qsos-leaflet/actions/runs/28704861246) to download the report.
RunnerID:28704861246

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start with the linked GitHub Actions ZAP report and the reported frontend URL to understand the nine missing security headers. Review the TypeScript frontend pipeline and its deployment configuration, then rerun ZAP against the frontend URL; done means the listed alerts are addressed or explicitly justified.

Written by the indexing model from the issue text.