ZAP API Scan Report

Open

#552 opened on Dec 17, 2025 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 25/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Stale
Tech stack: java
Domain: api, backend, security

Research direction

Start by downloading the ZAP report from GitHub Actions run 20288497121 and reviewing the listed endpoints, especially /api/v1/api-docs and /actuator/health. Then trace those routes in the Java API to identify the source of the reported headers, server errors, and content types. Done should be demonstrated by a follow-up scan showing whether the listed alerts are resolved.

Written by the indexing model from the issue text.

Description

Site: https://educ-rule-engine-api-77c02f-dev.apps.silver.devops.gov.bc.ca
New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 1:
  - https://educ-rule-engine-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs
- A Server Error response code was returned by the server [100000] total: 16:
- Permissions Policy Header Not Set [10063] total: 1:
  - https://educ-rule-engine-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs
- Strict-Transport-Security Header Not Set [10035] total: 1:
  - https://educ-rule-engine-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs
- Unexpected Content-Type was returned [100001] total: 16:
- Non-Storable Content [10049] total: 1:
  - https://educ-rule-engine-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs

View the following link to download the report.
RunnerID:20288497121

ZAP by Checkmarx

Dominant language: Java
Stars: 0
Forks: 2
PR merge metrics: No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Document Hot Rod migration version compatibility for Data Grid 8.6 Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

infinispan/infinispan#18150 · Opened Sep 21, 2026
[BUG] Route53Resolver: CreateResolverEndpoint requires IpAddressRequests, but the AWS member is IpAddresses, so no SDK client can call it Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

floci-io/floci#4108 · Opened Sep 21, 2026
[BUG] RestGetModelHandlerIT.testGetModel_whenModelIDIsInValid_thenFail depends on test order and fails when run alone Open

untriaged

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

opensearch-project/k-NN#3597 · Opened Sep 21, 2026
Concurrent builder skips 'verify' phase when running 'mvn install' Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

apache/maven#13230 · 1 comment · Opened Sep 21, 2026
ComponentGeNRTL leaves lnGamma stale after computing gamma Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

equinor/neqsim#3899 · 1 comment · Opened Sep 21, 2026

More Java issues