feat(lab5): ZAP baseline + auth + Semgrep + correlation

[Maflock]

Goal

Run DAST (ZAP, both unauthenticated and authenticated) against the running Juice Shop, then run SAST (Semgrep) against its source code, and correlate at least one vulnerability that appears in both reports.

Changes

• Added submissions/lab5.md

Testing

zap-baseline.py -t http://juice-shop:3000 -r baseline-report.html -J baseline-report.json
# Result: 10 alert types — 0 High, 2 Medium, 5 Low, 3 Informational.


zap.sh -cmd -autorun /zap/wrk/scripts/zap-auth.yaml -port 8090
# Result: 12 alert types — 1 High, 4 Medium, 3 Low, 4 Informational.


semgrep --config=p/owasp-top-ten --config=p/javascript --config=p/secrets \
  labs/lab5/semgrep/juice-shop --json -o labs/lab5/results/semgrep.json \
  --severity ERROR --severity WARNING --exclude='**/test/**' --exclude='**/node_modules/**'
# Result: 22 findings —  10 WARNING and 12 ERROR.

---

Artifacts & Screenshots

• submissions/lab5.md

Checklist

• Title is clear (feat(lab5): ZAP baseline + auth + Semgrep + correlation)
• No secrets/large temp files committed
• submissions/lab5.md exists
• Task 1 — ZAP baseline + auth + 10-20× ratio analysis
• Task 2 — Semgrep top-10 + triage shortcut
• Bonus — Correlation table with 1+ confirmed cross-tool finding