feat(lab10): defectdojo governance report + capstone walkthrough

[Maflock]

Goal

Spin up DefectDojo locally, import every scan report from Labs 4–9, apply the SLA matrix from Lecture 9, compute program metrics, and (bonus) produce a 5-minute interview-walkthrough script.

Changes

• Added submissions/laab10.md
• Added submissions/lab10-walkthrough.md

Testing

# 1. Clone and start DefectDojo
git clone https://github.com/DefectDojo/django-DefectDojo dd && cd dd
./docker/setEnv.sh dev && docker compose up -d
# DefectDojo v2.58.x running on localhost:8080, 7 containers healthy

# 2. Get admin credentials and API token
docker compose logs initializer | grep -i password
curl -s -H "Authorization: Token $DD_TOKEN" "$DD_URL/api/v2/products/" | jq .count
# Admin password extracted, API token generated, products count: 0

# 3. Create Product + Engagement via API
curl -X POST "$DD_URL/api/v2/products/" -H "Authorization: Token $DD_TOKEN" \
  -H "Content-Type: application/json" -d '{"name": "OWASP Juice Shop", "prod_type": 1}'
# Product ID: 1, Engagement ID: 1, status: In Progress

# 4. Import all scan reports from Labs 4-9
curl -X POST "$DD_URL/api/v2/import-scan/" -H "Authorization: Token $DD_TOKEN" \
  -F "scan_type=Trivy Scan" -F "engagement=1" -F "file=@../../lab7/results/trivy-image.json"
# 9 scan types imported: Grype (104), Trivy (113), Semgrep (22), ZAP (0), 
# Checkov (80), KICS (16), Trivy-image (50), Trivy-k8s (0) — 385 total raw findings

# 5. Verify dedup across tools
curl -s -H "Authorization: Token $DD_TOKEN" \
  "$DD_URL/api/v2/findings/?engagement=1&cve=CVE-2024-21626" | jq '.results | length'
# CVE-2024-21626: 3 source tools (Trivy, Grype, Trivy-image) merged into 1 finding

# 6. Apply SLA matrix and compute metrics
# SLA configured: Critical=24h, High=7d, Medium=30d, Low=90d
curl -s -H "Authorization: Token $DD_TOKEN" "$DD_URL/api/v2/findings/?active=true&limit=1" | jq .count
# 385 active findings, 0 mitigated (Day 0 baseline), SLA compliance: 100% (fragile)

---

Artifacts & Screenshots

• submissions/laab10.md
• submissions/lab10-walkthrough.md

Checklist

• Title is clear (feat(lab10): defectdojo governance report + capstone walkthrough)
• No secrets/large temp files committed
• submissions/lab10.md exists
• Task 1 — DefectDojo setup + imports + dedup proof
• Task 2 — Governance report with MTTD/MTTR/SLA/backlog
• Bonus — 5-minute walkthrough script with timed practice