ZAP API Scan Report

[github-actions]

• Site: https://ctx-api-stg.ccte.epa.gov
  New Alerts
  • Source Code Disclosure - Python [10099] total: 1:
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxval/search/by-dtxsid/
  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 12:
    • https://ctx-api-stg.ccte.epa.gov/docs/hazard.json
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/observations/search/by-dtxsid/DTXSID1037806
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/observations/search/by-study-id/63
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/summary/search/by-dtxsid/DTXSID1037806
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/summary/search/by-study-type/DEV
    • ..
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 1:
    • https://ctx-api-stg.ccte.epa.gov/docs/hazard.json
  • Strict-Transport-Security Header Not Set [10035] total: 11:
    • https://ctx-api-stg.ccte.epa.gov/docs/hazard.json
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/observations/search/by-dtxsid/DTXSID1037806
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/observations/search/by-study-id/63
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/summary/search/by-dtxsid/DTXSID1037806
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/summary/search/by-study-type/DEV
    • ..
  • Unexpected Content-Type was returned [100001] total: 18:
    • https://ctx-api-stg.ccte.epa.gov
    • https://ctx-api-stg.ccte.epa.gov/
    • https://ctx-api-stg.ccte.epa.gov/4400626518872997954
    • https://ctx-api-stg.ccte.epa.gov/docs
    • https://ctx-api-stg.ccte.epa.gov/docs/
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 12:
    • https://ctx-api-stg.ccte.epa.gov/docs/hazard.json
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/observations/search/by-dtxsid/DTXSID1037806
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/observations/search/by-study-id/63
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/summary/search/by-dtxsid/DTXSID1037806
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/summary/search/by-study-type/DEV
    • ..
  • Base64 Disclosure [10094] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/summary/search/by-study-type/DEV
    • https://ctx-api-stg.ccte.epa.gov/hazard/skin-eye/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxval/search/by-dtxsid/
  • Non-Storable Content [10049] total: 1:
    • https://ctx-api-stg.ccte.epa.gov/docs/hazard.json
  • Re-examine Cache-control Directives [10015] total: 12:
    • https://ctx-api-stg.ccte.epa.gov/docs/hazard.json
    • https://ctx-api-stg.ccte.epa.gov/hazard/pprtv/search/by-dtxsid/DTXSID7020182
    • https://ctx-api-stg.ccte.epa.gov/hazard/skin-eye/search/by-dtxsid/DTXSID0021125
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/effects/search/by-dtxsid/DTXSID1037806
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/effects/search/by-study-id/63
    • ..
  • Sec-Fetch-Dest Header is Missing [90005] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/hazard/cancer-summary/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/details/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/summary/search/by-dtxsid/
  • Sec-Fetch-Mode Header is Missing [90005] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/hazard/cancer-summary/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/details/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/summary/search/by-dtxsid/
  • Sec-Fetch-Site Header is Missing [90005] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/hazard/cancer-summary/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/details/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/summary/search/by-dtxsid/
  • Sec-Fetch-User Header is Missing [90005] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/hazard/cancer-summary/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/details/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/summary/search/by-dtxsid/
  • Storable but Non-Cacheable Content [10049] total: 11:
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/observations/search/by-dtxsid/DTXSID1037806
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/observations/search/by-study-id/63
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/summary/search/by-dtxsid/DTXSID1037806
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxref/summary/search/by-study-type/DEV
    • https://ctx-api-stg.ccte.epa.gov/hazard/toxval/search/by-dtxsid/DTXSID0021125
    • ..

View the following link to download the report.
RunnerID:18691300926

---

ZAP by Checkmarx

[github-actions]

• Site: https://ctx-api-stg.ccte.epa.gov
  New Alerts
  • Content Security Policy (CSP) Header Not Set [10038] total: 1:
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/details/search/by-dtxsid/
  • Application Error Disclosure [90022] total: 1:
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/details/search/by-dtxsid/
  • Information Disclosure - Debug Error Messages [10023] total: 1:
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/details/search/by-dtxsid/
  • Permissions Policy Header Not Set [10063] total: 1:
    • https://ctx-api-stg.ccte.epa.gov/hazard/genetox/details/search/by-dtxsid/

View the following link to download the report.
RunnerID:19137298812

[madison-feshuk]

@jpowel01 @JKenan could update the URLs used within the ZAP API Scan Reports to https://comptox.epa.gov/ctx-api/? @bridirks says it's a devOps issue and outside her control

[github-actions]

• Site: https://ctx-api-stg.ccte.epa.gov
  Resolved Alerts
  • Content Security Policy (CSP) Header Not Set [10038] total: 1:
  • Application Error Disclosure [90022] total: 1:
  • Information Disclosure - Debug Error Messages [10023] total: 1:
  • Permissions Policy Header Not Set [10063] total: 1:

View the following link to download the report.
RunnerID:19308354997

[bridirks]

@jpowel01 @JKenan
These Scans pass. We really just need to know if these issues need to be kept in the Repo and to what extent. Do we only keep the most recent? Are there additional checks or feedback needed based on results? Etc.