feat(lab10): defectdojo governance report + capstone walkthrough

[Wilikson173]

Goal

Stand up a local DefectDojo instance, import findings from Labs 4–7, apply an SLA matrix, and produce a governance report plus a timed interview walkthrough script for the DevSecOps capstone.

Changes

• submissions/lab10.md — added: DefectDojo setup notes, Product/Engagement details, import log, dedup investigation, applied SLA matrix, governance report with real severity/metrics data
• submissions/lab10-walkthrough.md — added: 5-minute interview walkthrough script with timed sections and Q&A prep
• .gitignore — updated to exclude labs/lab10/work/dd/ (upstream DefectDojo clone, not part of this submission)

Testing

# DefectDojo containers up
docker compose ps -a

# Product created
curl -s -X POST "$DD_URL/api/v2/products/" -H "Authorization: Token $DD_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "OWASP Juice Shop", "prod_type": 1}'
# → {"id":1, ...}

# Engagement created
curl -s -X POST "$DD_URL/api/v2/engagements/" -H "Authorization: Token $DD_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Course Semester Run", "product": 1, "engagement_type": "CI/CD", "status": "In Progress"}'
# → {"id":1, ...}

# 6 scan types imported (Trivy x2, Semgrep, Checkov, KICS, Trivy Operator)
curl -s -X POST "$DD_URL/api/v2/import-scan/" -H "Authorization: Token $DD_TOKEN" \
  -F "scan_type=Trivy Scan" -F "engagement=1" \
  -F "product_name=OWASP Juice Shop" -F "engagement_name=Course Semester Run" \
  -F "file=@labs/lab7/results/trivy-image.json"
# → 50 findings imported (test_id: 5)

# Total findings verified after cleanup of a duplicate test
curl -s -H "Authorization: Token $DD_TOKEN" \
  "$DD_URL/api/v2/findings/?engagement=1&limit=1" | jq .count
# → 242

# SLA matrix applied and confirmed linked to product
curl -s -X PATCH "$DD_URL/api/v2/sla_configurations/1/" -H "Authorization: Token $DD_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"critical": 1, "high": 7, "medium": 30, "low": 90}'
curl -s -H "Authorization: Token $DD_TOKEN" "$DD_URL/api/v2/products/1/" | jq '{name, sla_configuration}'
# → {"name":"OWASP Juice Shop","sla_configuration":1}

Artifacts & Screenshots

• submissions/lab10.md
• submissions/lab10-walkthrough.md

---

Checklist

• Title follows feat(lab10): <topic> style
• No secrets or large temp files committed
• Submission file exists at submissions/lab10.md