ZAP Security Report: frontend
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
- Site: [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 3:
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Permissions Policy Header Not Set** [10063] total: 3:
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Strict-Transport-Security Header Not Set** [10035] total: 3:
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
- **Non-Storable Content** [10049] total: 3:
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/)
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/robots.txt)
- [https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml](https://tryquickstart-test-frontend.apps.silver.devops.gov.bc.ca/sitemap.xml)
View the [following link](https://github.com/bcgov/tryquickstart/actions/runs/28704869981) to download the report.
RunnerID:28704869981
---
[ZAP by Checkmarx](https://checkmarx.com/)
Contributor guide
Research direction
Start by downloading the ZAP report from the linked GitHub Actions run and reviewing the three affected frontend URLs, including robots.txt and sitemap.xml. Identify where response headers are configured, then verify that the reported CSP, Permissions Policy, Strict-Transport-Security, and Non-Storable Content alerts are resolved for all listed endpoints.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100