ZAP API Scan Report

Open

#101 opened on Mar 20, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Quiet
Tech stack: java, spring
Domain: api, backend, security

Research direction

Start with the linked GitHub Actions ZAP report and review each listed alert, especially the Spring Actuator information leak, cookie attributes, and missing response headers. Determine which findings are actionable application issues versus scanner responses, then rerun the API scan and confirm the addressed alerts no longer appear.

Written by the indexing model from the issue text.

Description

Site: https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca
New Alerts
- Spring Actuator Information Leak [40042] total: 1:
  - https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health
- A Server Error response code was returned by the server [100000] total: 7:
- Cookie with SameSite Attribute None [10054] total: 5:
- Cross-Origin-Resource-Policy Header Missing or Invalid [90004] total: 1:
  - https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- Unexpected Content-Type was returned [100001] total: 7:
- A Client Error response code was returned by the server [100000] total: 25:
- Non-Storable Content [10049] total: 5:
- Session Management Response Identified [10112] total: 7:

View the following link to download the report.
RunnerID:23358893478

ZAP by Checkmarx

Dominant language: Java
Stars: 4
Forks: 3
Avg merge: 1h 12m
Merged PRs (30d): 1

Getting set up

Ships a Dockerfile or Docker Compose file
No pull request template
No contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[Bug]: 1.3.0 container images still trust emSign ECC Root CA - G3
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 68/100

strimzi/strimzi-kafka-operator#13328 · 1 comment · 3 reactions · Opened Oct 27, 2026

Maintainers usually reply within 1 day
SVT: LMP 4.0.0-SNAPSHOT generateFeatures results in 5 duplicate ee10 INFO messages displayed in Terminal output
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 67/100

OpenLiberty/ci.maven#2137 · Opened Oct 27, 2026

Maintainers usually reply within 1 day
Payer adjustment can exceed the balance left after copay and deductible, so claim payments add up to more than the charge
Possibly taken @DG47 claimed this today. Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 79/100

synthetichealth/synthea#1772 · Opened Oct 27, 2026

Maintainers usually reply within 13 days
NullPointerException on updating harvested metadata records on WEBDAV/WAF
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 72/100

geonetwork/core-geonetwork#9592 · Opened Oct 27, 2026

Maintainers usually reply within 2 days
x86/x64 Windows cspec: security_check_cookie and __RTC_CheckEsp call fixups leave the return address on the stack
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 75/100

NationalSecurityAgency/ghidra#10040 · Opened Oct 27, 2026

Maintainers usually reply within 2 days

More Java issues

ZAP API Scan Report

Is something wrong?

Assessment

Research direction

Description

Getting set up

First steps

More from bcgov/EDUC-SOAM-API

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Similar issues

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Get new issues in your inbox