feat(lab5): ZAP baseline + auth + Semgrep + correlation

[demonit4028]

Goal

Run DAST (ZAP baseline + authenticated) and SAST (Semgrep) against Juice Shop v20.0.0, correlate findings.

Changes

• submissions/lab5.md — full analysis with severity tables, ratio, triage, and SAST/DAST correlation

Testing

• ZAP baseline: 10 alerts (unauth, passive only)
• ZAP authenticated: 12 alerts (1x High SQLi, 4x Medium, 3x Low, 4x Info)
• Semgrep: 22 findings (12 ERROR, 10 WARNING) with p/owasp-top-ten + p/javascript + p/secrets
• Correlation confirmed: SQL Injection at /rest/products/search ↔ routes/search.ts:23

Artifacts & Screenshots

• submissions/lab5.md

---

Checklist

• Title follows feat(labN): <topic> format
• No secrets or large temp files committed
• Submission file at submissions/labN.md exists