Feature/lab10

[sedimentt]

Goal

Load the Lab 4–7 scanner output into DefectDojo 2.58.3, collapse duplicates, set and defend SLAs, and report vulnerability-management metrics, a risk acceptance and an executive summary.

Changes

• submissions/lab10.md — report for Task 1, Task 2 and the Bonus reflection
• `submissions/lab10e interviewwalkthrough (~710 words)

Testing

• DefectDojo started with the release profile. Pinning the clone did
  not pin the images (latest, whichstarted 3.4.0), so I restarted with DJANGO_VERSION=2.58.3 NGINX_VERSION=2.58.3: dojo.version→ 2.58.3`
• API token from /act OWASP Juice Shopand engagementCourse Semester Run` created through the API
• run-imports.sh i first run; fixed the other two:
  • ZAP: the 2.58.3 converted the savedLab 5 JSON report to ZAP XML (13 alerts, 43 instances, same as the
    original) → 13 findi
  • trivy-k8s.json: Trivy Operator Scan imported it with 0
    findings because thenot Operator CRDs;re-imported as Trivy Scan → 174 findings
• 852 findings impord ran manage.pydedupe → 174 duplicates, 678 active
• Unique-vulnerabilinent + version: 542active SCA rows → 239 unique; about 375 distinct issues across the
  project
• SLA changed through the API from 7/30/90/120 to 3/14/60/180 days;
  DefectDojo recalcula
• Risk acceptance created in DefectDojo for 11 decompress@4.2.1
  findings (no fixed r reachable), expiry2027-01-09 → 667 active
• Metrics: DefectDojLA because findingsare dated by import date. Dated by when each scan actually ran: median
  age 24 days, 62.8% i

Artifacts & Scree

• Report: `submissio
• Walkthrough: submissions/lab10-walkthrough.md
• labs/lab10/work/les are not committed (in .gitignore)

Checklist

• Title is clear (feat(lab10): defectdojo capstone + governance report)
• No secrets/large temp files committed
• Submission filxists