diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 000000000..df6d3ab42
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,13 @@
+## Goal
+
+
+## Changes
+-
+
+## Testing
+
+
+## Checklist
+- [ ] Title is a clear sentence (<= 70 chars)
+- [ ] Commits are signed (`git log --show-signature`)
+- [ ] `submissions/labN.md` updated
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..4d95be962
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,100 @@
+name: quicknotes-ci
+
+on:
+ push:
+ branches:
+ - main
+ paths:
+ - app/**
+ - .github/workflows/ci.yml
+ pull_request:
+ branches:
+ - main
+ paths:
+ - app/**
+ - .github/workflows/ci.yml
+
+permissions:
+ contents: read
+
+defaults:
+ run:
+ working-directory: app
+
+jobs:
+ vet:
+ name: vet (go ${{ matrix.go-version }})
+ runs-on: ubuntu-24.04
+ strategy:
+ fail-fast: false
+ matrix:
+ go-version:
+ - "1.23"
+ - "1.24"
+ steps:
+ - name: Checkout
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ - name: Set up Go
+ uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+ with:
+ go-version: ${{ matrix.go-version }}
+ cache: true
+ cache-dependency-path: app/go.mod
+ - name: Run go vet
+ run: go vet ./...
+
+ test:
+ name: test (go ${{ matrix.go-version }})
+ runs-on: ubuntu-24.04
+ strategy:
+ fail-fast: false
+ matrix:
+ go-version:
+ - "1.23"
+ - "1.24"
+ steps:
+ - name: Checkout
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ - name: Set up Go
+ uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+ with:
+ go-version: ${{ matrix.go-version }}
+ cache: true
+ cache-dependency-path: app/go.mod
+ - name: Run tests with race detector
+ run: go test -race -count=1 ./...
+
+ lint:
+ name: lint
+ runs-on: ubuntu-24.04
+ steps:
+ - name: Checkout
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ - name: Set up Go
+ uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+ with:
+ go-version: "1.24"
+ cache: true
+ cache-dependency-path: app/go.mod
+ - name: Install golangci-lint
+ run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
+ - name: Run golangci-lint
+ run: golangci-lint run
+
+ govulncheck:
+ name: govulncheck
+ runs-on: ubuntu-24.04
+ steps:
+ - name: Checkout
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ - name: Set up Go
+ uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+ with:
+ go-version: "1.24"
+ cache: true
+ cache-dependency-path: app/go.mod
+ - name: Install govulncheck
+ run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
+ - name: Run govulncheck
+ working-directory: app
+ run: govulncheck ./...
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..d42d1af1f
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,47 @@
+name: quicknotes-release
+
+on:
+ push:
+ tags:
+ - "v*"
+
+permissions:
+ contents: read
+ packages: write
+
+env:
+ IMAGE_NAME: ghcr.io/ilyapechersky/devops-intro/quicknotes
+
+jobs:
+ release:
+ name: build and push image
+ runs-on: ubuntu-24.04
+ steps:
+ - name: Checkout
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+ - name: Log in to ghcr.io
+ uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+ with:
+ registry: ghcr.io
+ username: ${{ github.actor }}
+ password: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Docker metadata
+ id: meta
+ uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+ with:
+ images: ${{ env.IMAGE_NAME }}
+ tags: |
+ type=semver,pattern={{version}}
+ type=raw,value=latest,enable={{is_default_branch}}
+
+ - name: Build and push
+ uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+ with:
+ context: ./app
+ push: true
+ tags: |
+ ${{ env.IMAGE_NAME }}:${{ github.ref_name }}
+ ${{ env.IMAGE_NAME }}:latest
+ labels: ${{ steps.meta.outputs.labels }}
diff --git a/app/Dockerfile b/app/Dockerfile
new file mode 100644
index 000000000..c85ef7667
--- /dev/null
+++ b/app/Dockerfile
@@ -0,0 +1,53 @@
+# syntax=docker/dockerfile:1
+
+FROM golang:1.24-alpine AS builder
+
+WORKDIR /src
+
+COPY go.mod ./
+COPY go.sum* ./
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
+ -trimpath \
+ -ldflags='-s -w' \
+ -o /out/quicknotes .
+
+RUN mkdir -p /tmp/healthcheck && \
+ printf '%s\n' \
+ 'package main' \
+ '' \
+ 'import (' \
+ ' "net/http"' \
+ ' "os"' \
+ ')' \
+ '' \
+ 'func main() {' \
+ ' resp, err := http.Get("http://127.0.0.1:8080/health")' \
+ ' if err != nil || resp.StatusCode != http.StatusOK {' \
+ ' os.Exit(1)' \
+ ' }' \
+ '}' \
+ > /tmp/healthcheck/main.go && \
+ CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
+ -trimpath \
+ -ldflags='-s -w' \
+ -o /out/healthcheck /tmp/healthcheck/main.go
+
+RUN mkdir -p /empty-data && chown 65532:65532 /empty-data
+
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY --from=builder /out/quicknotes /quicknotes
+COPY --from=builder /out/healthcheck /healthcheck
+COPY seed.json /seed.json
+COPY --from=builder --chown=65532:65532 /empty-data /data
+
+USER nonroot:nonroot
+EXPOSE 8080
+ENTRYPOINT ["/quicknotes"]
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=3 \
+ CMD ["/healthcheck"]
diff --git a/app/handlers.go b/app/handlers.go
index c534979c5..2eb6f46dd 100644
--- a/app/handlers.go
+++ b/app/handlers.go
@@ -28,6 +28,7 @@ func NewServer(store *Store) *Server {
func (s *Server) Routes() *http.ServeMux {
mux := http.NewServeMux()
+ mux.HandleFunc("GET /", s.wrap(s.handleRoot))
mux.HandleFunc("GET /health", s.wrap(s.handleHealth))
mux.HandleFunc("GET /metrics", s.wrap(s.handleMetrics))
mux.HandleFunc("GET /notes", s.wrap(s.handleListNotes))
@@ -58,6 +59,10 @@ func (s *Server) wrap(h http.HandlerFunc) http.HandlerFunc {
}
}
+func (s *Server) handleRoot(w http.ResponseWriter, r *http.Request) {
+ writeJSON(w, http.StatusOK, map[string]string{"service": "quicknotes"})
+}
+
func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
writeJSON(w, http.StatusOK, map[string]any{
"status": "ok",
diff --git a/app/main.go b/app/main.go
index e258ffcfe..331bc8450 100644
--- a/app/main.go
+++ b/app/main.go
@@ -28,7 +28,7 @@ func main() {
server := NewServer(store)
srv := &http.Server{
Addr: addr,
- Handler: server.Routes(),
+ Handler: securityHeaders(server.Routes()),
ReadHeaderTimeout: 5 * time.Second,
}
diff --git a/app/security.go b/app/security.go
new file mode 100644
index 000000000..13d2518ab
--- /dev/null
+++ b/app/security.go
@@ -0,0 +1,18 @@
+package main
+
+import "net/http"
+
+func securityHeaders(next http.Handler) http.Handler {
+ return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ h := w.Header()
+ h.Set("X-Content-Type-Options", "nosniff")
+ h.Set("X-Frame-Options", "DENY")
+ h.Set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'")
+ h.Set("Referrer-Policy", "no-referrer")
+ h.Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
+ h.Set("Cross-Origin-Opener-Policy", "same-origin")
+ h.Set("Cross-Origin-Resource-Policy", "same-origin")
+ h.Set("X-XSS-Protection", "0")
+ next.ServeHTTP(w, r)
+ })
+}
diff --git a/app/security_test.go b/app/security_test.go
new file mode 100644
index 000000000..81aa4bde0
--- /dev/null
+++ b/app/security_test.go
@@ -0,0 +1,30 @@
+package main
+
+import (
+ "net/http"
+ "net/http/httptest"
+ "testing"
+)
+
+func TestSecurityHeaders_OnAllRoutes(t *testing.T) {
+ srv := newTestServer(t)
+ handler := securityHeaders(srv.Routes())
+
+ for _, path := range []string{"/", "/health", "/notes", "/metrics"} {
+ t.Run(path, func(t *testing.T) {
+ rec := httptest.NewRecorder()
+ req := httptest.NewRequest(http.MethodGet, path, nil)
+ handler.ServeHTTP(rec, req)
+
+ if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+ t.Fatalf("%s: X-Content-Type-Options = %q, want nosniff", path, got)
+ }
+ if got := rec.Header().Get("X-Frame-Options"); got != "DENY" {
+ t.Fatalf("%s: X-Frame-Options = %q, want DENY", path, got)
+ }
+ if got := rec.Header().Get("Content-Security-Policy"); got == "" {
+ t.Fatalf("%s: Content-Security-Policy missing", path)
+ }
+ })
+ }
+}
diff --git a/cloud/Dockerfile b/cloud/Dockerfile
new file mode 100644
index 000000000..8bf41b3bd
--- /dev/null
+++ b/cloud/Dockerfile
@@ -0,0 +1,5 @@
+FROM ghcr.io/ilyapechersky/devops-intro/quicknotes:v0.1.1
+
+ENV ADDR=0.0.0.0:8080
+ENV DATA_PATH=/data/notes.json
+ENV SEED_PATH=/seed.json
diff --git a/cloud/README.md b/cloud/README.md
new file mode 100644
index 000000000..27d861729
--- /dev/null
+++ b/cloud/README.md
@@ -0,0 +1,21 @@
+---
+title: QuickNotes Lab 10
+emoji: π
+colorFrom: blue
+colorTo: green
+sdk: docker
+app_port: 8080
+pinned: false
+---
+
+# QuickNotes on Hugging Face Spaces
+
+This Space runs the Lab 6 QuickNotes image published to GitHub Container Registry.
+
+Public API endpoints:
+
+- `GET /health`
+- `GET /notes`
+- `POST /notes`
+
+Image source: `ghcr.io/ilyapechersky/devops-intro/quicknotes:v0.1.1`
diff --git a/cloud/teardown.md b/cloud/teardown.md
new file mode 100644
index 000000000..6461b1a49
--- /dev/null
+++ b/cloud/teardown.md
@@ -0,0 +1,25 @@
+# Lab 10 teardown
+
+## Hugging Face Space
+
+1. Open https://huggingface.co/spaces/IlyaPechersky/quicknotes-lab10/settings
+2. Scroll to **Delete this Space**
+3. Confirm deletion
+
+## Cloudflare quick tunnel
+
+Stop the local `cloudflared` process. Quick tunnel URLs are ephemeral and stop working when the process exits.
+
+## GitHub Container Registry package
+
+The `quicknotes` package can stay public for course review. To remove it later:
+
+1. Open https://github.com/users/IlyaPechersky/packages/container/devops-intro%2Fquicknotes/settings
+2. Delete the package version or the whole package if no longer needed
+
+## Git tag
+
+```bash
+git push --delete origin v0.1.1
+git tag -d v0.1.1
+```
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 000000000..ede3df2f4
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,31 @@
+services:
+ quicknotes:
+ build:
+ context: ./app
+ dockerfile: Dockerfile
+ image: quicknotes:lab6
+ ports:
+ - "8080:8080"
+ environment:
+ ADDR: "0.0.0.0:8080"
+ DATA_PATH: "/data/notes.json"
+ SEED_PATH: "/seed.json"
+ volumes:
+ - quicknotes-data:/data
+ restart: unless-stopped
+ cap_drop:
+ - ALL
+ read_only: true
+ tmpfs:
+ - /tmp
+ security_opt:
+ - no-new-privileges:true
+ healthcheck:
+ test: ["CMD", "/healthcheck"]
+ interval: 10s
+ timeout: 3s
+ retries: 3
+ start_period: 5s
+
+volumes:
+ quicknotes-data:
diff --git a/lab9-artifacts/govulncheck-green.txt b/lab9-artifacts/govulncheck-green.txt
new file mode 100644
index 000000000..e7589224d
--- /dev/null
+++ b/lab9-artifacts/govulncheck-green.txt
@@ -0,0 +1 @@
+No vulnerabilities found.
diff --git a/lab9-artifacts/govulncheck-red-verbose.txt b/lab9-artifacts/govulncheck-red-verbose.txt
new file mode 100644
index 000000000..fcd77348c
--- /dev/null
+++ b/lab9-artifacts/govulncheck-red-verbose.txt
@@ -0,0 +1,170 @@
+Fetching vulnerabilities from the database...
+
+Checking the code against the vulnerabilities...
+
+The package pattern matched the following root package:
+ quicknotes
+Govulncheck scanned the following 2 modules and the go1.26.4 standard library:
+ quicknotes
+ golang.org/x/crypto@v0.12.0
+
+=== Symbol Results ===
+
+No vulnerabilities found.
+
+=== Package Results ===
+
+No other vulnerabilities found.
+
+=== Module Results ===
+
+Vulnerability #1: GO-2026-5033
+ Invoking pathological inputs can lead to client panic in
+ golang.org/x/crypto/ssh/agent
+ More info: https://pkg.go.dev/vuln/GO-2026-5033
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #2: GO-2026-5023
+ Invoking VerifiedPublicKeyCallback permissions skip enforcement in
+ golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2026-5023
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #3: GO-2026-5021
+ Invoking auth bypass via unenforced @revoked status in
+ golang.org/x/crypto/ssh/knownhosts
+ More info: https://pkg.go.dev/vuln/GO-2026-5021
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #4: GO-2026-5020
+ Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2026-5020
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #5: GO-2026-5019
+ Invoking bypass of FIDO/U2F security keys physical interaction in
+ golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2026-5019
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #6: GO-2026-5018
+ Invoking pathological RSA/DSA parameters may cause DoS in
+ golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2026-5018
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #7: GO-2026-5017
+ Invoking client can cause server deadlock on unexpected responses in
+ golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2026-5017
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #8: GO-2026-5016
+ Invoking memory leak when rejecting channels can lead to DoS in
+ golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2026-5016
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #9: GO-2026-5015
+ Invoking server panic during CheckHostKey/Authenticate in
+ golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2026-5015
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #10: GO-2026-5014
+ Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2026-5014
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #11: GO-2026-5013
+ Invoking byte arithmetic causes underflow and panic in
+ golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2026-5013
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #12: GO-2026-5006
+ Invoking agent constraints dropped when forwarding keys in
+ golang.org/x/crypto/ssh/agent
+ More info: https://pkg.go.dev/vuln/GO-2026-5006
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #13: GO-2026-5005
+ Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
+ More info: https://pkg.go.dev/vuln/GO-2026-5005
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #14: GO-2025-4135
+ Malformed constraint may cause denial of service in
+ golang.org/x/crypto/ssh/agent
+ More info: https://pkg.go.dev/vuln/GO-2025-4135
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.45.0
+
+Vulnerability #15: GO-2025-4134
+ Unbounded memory consumption in golang.org/x/crypto/ssh
+ More info: https://pkg.go.dev/vuln/GO-2025-4134
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.45.0
+
+Vulnerability #16: GO-2025-4116
+ Potential denial of service in golang.org/x/crypto/ssh/agent
+ More info: https://pkg.go.dev/vuln/GO-2025-4116
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.43.0
+
+Vulnerability #17: GO-2025-3487
+ Potential denial of service in golang.org/x/crypto
+ More info: https://pkg.go.dev/vuln/GO-2025-3487
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.35.0
+
+Vulnerability #18: GO-2024-3321
+ Misuse of connection.serverAuthenticate may cause authorization bypass in
+ golang.org/x/crypto
+ More info: https://pkg.go.dev/vuln/GO-2024-3321
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.31.0
+
+Vulnerability #19: GO-2023-2402
+ Man-in-the-middle attacker can compromise integrity of secure channel in
+ golang.org/x/crypto
+ More info: https://pkg.go.dev/vuln/GO-2023-2402
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.17.0
+
+Your code is affected by 0 vulnerabilities.
+This scan also found 0 vulnerabilities in packages you import and 19
+vulnerabilities in modules you require, but your code doesn't appear to call
+these vulnerabilities.
diff --git a/lab9-artifacts/govulncheck-red.txt b/lab9-artifacts/govulncheck-red.txt
new file mode 100644
index 000000000..caf884d6c
--- /dev/null
+++ b/lab9-artifacts/govulncheck-red.txt
@@ -0,0 +1 @@
+bash: line 55: govulncheck: command not found
diff --git a/lab9-artifacts/quicknotes.sbom.cdx.json b/lab9-artifacts/quicknotes.sbom.cdx.json
new file mode 100644
index 000000000..6cc333f40
--- /dev/null
+++ b/lab9-artifacts/quicknotes.sbom.cdx.json
@@ -0,0 +1,40 @@
+{
+ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+ "bomFormat": "CycloneDX",
+ "specVersion": "1.6",
+ "serialNumber": "urn:uuid:4ee1a9b4-26cd-47e7-a4ef-d586c2403124",
+ "version": 1,
+ "metadata": {
+ "timestamp": "2026-07-07T20:15:26+00:00",
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "0.59.1"
+ }
+ ]
+ },
+ "component": {
+ "bom-ref": "pkg:oci/quicknotes@sha256%3Abc6608800edb9b891d140ad996406ea18146f315d21002f883d24cbddfe4aa1a?arch=amd64&repository_url=index.docker.io%2Flibrary%2Fquicknotes",
+ "type": "container",
+ "name": "quicknotes:lab6",
+ "purl": "pkg:oci/quicknotes@sha256%3Abc6608800edb9b891d140ad996406ea18146f315d21002f883d24cbddfe4aa1a?arch=amd64&repository_url=index.docker.io%2Flibrary%2Fquicknotes",
+ "properties": [
+ {
+ "name": "aquasecurity:trivy:DiffID",
+ "value": "sha256:114dde0fefebbca13165d0da9c500a66190e497a82a53dcaabc3172d630be1e9"
+ },
+ {
+ "name": "aquasecurity:trivy:DiffID",
+ "value": "sha256:17205d2b1ac5677df7647a5491d62bba00a448b96238f554a0896acbe54c4628"
+ },
+ {
+ "name": "aquasecurity:trivy:DiffID",
+ "value": "sha256:24dcaaa0cc6b962b906f28bd71dc8b30daac12ed710bf2991139be50d4a87cc0"
+ },
+ {
+ "name": "aquasecurity:trivy:DiffID",
+ "value": "sha256:33b37ab0b0901175c2699d81c10b0c887f0dff944de74763cca00c155904d6fb"
+ },
diff --git a/lab9-artifacts/trivy-config.txt b/lab9-artifacts/trivy-config.txt
new file mode 100644
index 000000000..e69de29bb
diff --git a/lab9-artifacts/trivy-fs.txt b/lab9-artifacts/trivy-fs.txt
new file mode 100644
index 000000000..0081f144d
--- /dev/null
+++ b/lab9-artifacts/trivy-fs.txt
@@ -0,0 +1,16 @@
+Unable to find image 'aquasec/trivy:0.59.1' locally
+0.59.1: Pulling from aquasec/trivy
+4784322f1001: Pulling fs layer
+b8fb5a6dd3c2: Pulling fs layer
+cb8611c9fe51: Pulling fs layer
+feb3d185a00a: Pulling fs layer
+4784322f1001: Download complete
+cb8611c9fe51: Download complete
+cb8611c9fe51: Pull complete
+feb3d185a00a: Download complete
+feb3d185a00a: Pull complete
+b8fb5a6dd3c2: Download complete
+4784322f1001: Pull complete
+b8fb5a6dd3c2: Pull complete
+Digest: sha256:029e990b328d149bf0a9ffe355919041e1f86192db2df47e217f8a36dd42ceac
+Status: Downloaded newer image for aquasec/trivy:0.59.1
diff --git a/lab9-artifacts/trivy-image.txt b/lab9-artifacts/trivy-image.txt
new file mode 100644
index 000000000..1e4d9dca2
--- /dev/null
+++ b/lab9-artifacts/trivy-image.txt
@@ -0,0 +1,107 @@
+
+quicknotes:lab6 (debian 12.14)
+==============================
+Total: 0 (HIGH: 0, CRITICAL: 0)
+
+
+healthcheck (gobinary)
+======================
+Total: 11 (HIGH: 11, CRITICAL: 0)
+
+βββββββββββ¬βββββββββββββββββ¬βββββββββββ¬βββββββββ¬ββββββββββββββββββββ¬ββββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
+β Library β Vulnerability β Severity β Status β Installed Version β Fixed Version β Title β
+βββββββββββΌβββββββββββββββββΌβββββββββββΌβββββββββΌββββββββββββββββββββΌββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β stdlib β CVE-2026-25679 β HIGH β fixed β v1.24.13 β 1.25.8, 1.26.1 β net/url: Incorrect parsing of IPv6 host literals in net/url β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-25679 β
+β ββββββββββββββββββ€ β β βββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-27145 β β β β 1.25.11, 1.26.4 β crypto/x509: golang: golang crypto/x509: Denial of Service β
+β β β β β β β via excessive processing of DNS... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-27145 β
+β ββββββββββββββββββ€ β β βββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-32280 β β β β 1.25.9, 1.26.2 β crypto/x509: crypto/tls: golang: Go: Denial of Service β
+β β β β β β β vulnerability in certificate chain building... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-32280 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-32281 β β β β β crypto/x509: golang: Go crypto/x509: Denial of Service via β
+β β β β β β β inefficient certificate chain validation... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-32281 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-32283 β β β β β crypto/tls: golang: Go crypto/tls: Denial of Service via β
+β β β β β β β multiple TLS 1.3 key... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-32283 β
+β ββββββββββββββββββ€ β β βββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-33811 β β β β 1.25.10, 1.26.3 β net: golang: Go net package: Denial of Service via long β
+β β β β β β β CNAME response... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-33811 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-33814 β β β β β net/http/internal/http2: golang: golang.org/x/net: Go β
+β β β β β β β HTTP/2: Denial of Service via malformed β
+β β β β β β β SETTINGS_MAX_FRAME_SIZE frame... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-33814 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-39820 β β β β β net/mail: golang: Go net/mail: Denial of Service via crafted β
+β β β β β β β email inputs β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-39820 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-39836 β β β β β ELSA-2026-22121: golang security update (IMPORTANT) β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-39836 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-42499 β β β β β net/mail: golang: net/mail: Denial of Service via β
+β β β β β β β pathological email address parsing β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-42499 β
+β ββββββββββββββββββ€ β β βββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-42504 β β β β 1.25.11, 1.26.4 β Decoding a maliciously-crafted MIME header containing many β
+β β β β β β β invalid enc ... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-42504 β
+βββββββββββ΄βββββββββββββββββ΄βββββββββββ΄βββββββββ΄ββββββββββββββββββββ΄ββββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
+
+quicknotes (gobinary)
+=====================
+Total: 11 (HIGH: 11, CRITICAL: 0)
+
+βββββββββββ¬βββββββββββββββββ¬βββββββββββ¬βββββββββ¬ββββββββββββββββββββ¬ββββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
+β Library β Vulnerability β Severity β Status β Installed Version β Fixed Version β Title β
+βββββββββββΌβββββββββββββββββΌβββββββββββΌβββββββββΌββββββββββββββββββββΌββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β stdlib β CVE-2026-25679 β HIGH β fixed β v1.24.13 β 1.25.8, 1.26.1 β net/url: Incorrect parsing of IPv6 host literals in net/url β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-25679 β
+β ββββββββββββββββββ€ β β βββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-27145 β β β β 1.25.11, 1.26.4 β crypto/x509: golang: golang crypto/x509: Denial of Service β
+β β β β β β β via excessive processing of DNS... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-27145 β
+β ββββββββββββββββββ€ β β βββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-32280 β β β β 1.25.9, 1.26.2 β crypto/x509: crypto/tls: golang: Go: Denial of Service β
+β β β β β β β vulnerability in certificate chain building... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-32280 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-32281 β β β β β crypto/x509: golang: Go crypto/x509: Denial of Service via β
+β β β β β β β inefficient certificate chain validation... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-32281 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-32283 β β β β β crypto/tls: golang: Go crypto/tls: Denial of Service via β
+β β β β β β β multiple TLS 1.3 key... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-32283 β
+β ββββββββββββββββββ€ β β βββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-33811 β β β β 1.25.10, 1.26.3 β net: golang: Go net package: Denial of Service via long β
+β β β β β β β CNAME response... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-33811 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-33814 β β β β β net/http/internal/http2: golang: golang.org/x/net: Go β
+β β β β β β β HTTP/2: Denial of Service via malformed β
+β β β β β β β SETTINGS_MAX_FRAME_SIZE frame... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-33814 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-39820 β β β β β net/mail: golang: Go net/mail: Denial of Service via crafted β
+β β β β β β β email inputs β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-39820 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-39836 β β β β β ELSA-2026-22121: golang security update (IMPORTANT) β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-39836 β
+β ββββββββββββββββββ€ β β β ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-42499 β β β β β net/mail: golang: net/mail: Denial of Service via β
+β β β β β β β pathological email address parsing β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-42499 β
+β ββββββββββββββββββ€ β β βββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
+β β CVE-2026-42504 β β β β 1.25.11, 1.26.4 β Decoding a maliciously-crafted MIME header containing many β
+β β β β β β β invalid enc ... β
+β β β β β β β https://avd.aquasec.com/nvd/cve-2026-42504 β
+βββββββββββ΄βββββββββββββββββ΄βββββββββββ΄βββββββββ΄ββββββββββββββββββββ΄ββββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
diff --git a/lab9-artifacts/zap-baseline-after.html b/lab9-artifacts/zap-baseline-after.html
new file mode 100644
index 000000000..617b61264
--- /dev/null
+++ b/lab9-artifacts/zap-baseline-after.html
@@ -0,0 +1,598 @@
+
+
+
+
+ZAP Scanning Report
+
+
+
+
+
+ 
+ ZAP Scanning Report
+
+
+
+
+
+
+ Site: http://127.0.0.1:8080
+
+
+
+
+ Generated on Tue, 7 Jul 2026 20:10:16
+
+
+
+ ZAP Version: 2.16.1
+
+
+
+
+
+
+
+
+ | Risk Level |
+ Number of Alerts |
+
+
+ |
+ High
+ |
+
+ 0
+ |
+
+
+ |
+ Medium
+ |
+
+ 0
+ |
+
+
+ |
+ Low
+ |
+
+ 1
+ |
+
+
+ |
+ Informational
+ |
+
+ 1
+ |
+
+
+ |
+ False Positives:
+ |
+
+ 0
+ |
+
+
+
+
+
+
+
+ Summary of Sequences
+ For each step: result (Pass/Fail) - risk (of highest alert(s) for the step, if any).
+
+
+
+
+
+
+ Alerts
+
+
+
+
+
+ Alert Detail
+
+
+
+ |
+ Low |
+ ZAP is Out of Date |
+
+
+ | Description |
+
+ The version of ZAP you are using to test your app is out of date and is no longer being updated.
+
+
+ The risk level is set based on how out of date your ZAP version is.
+
+ |
+
+
+ |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/robots.txt |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ The latest version of ZAP is 2.17.0 |
+
+
+
+ | Instances |
+
+
+ 1 |
+
+
+
+ | Solution |
+
+ Download the latest version of ZAP from https://www.zaproxy.org/download/ and install it.
+
+ |
+
+
+ | Reference |
+
+ https://www.zaproxy.org/download/
+
+ |
+
+
+ | CWE Id |
+ 1104 |
+
+
+ | WASC Id |
+ 45 |
+
+
+ | Plugin Id |
+ 10116 |
+
+
+
+
+
+
+ |
+ Informational |
+ Storable and Cacheable Content |
+
+
+ | Description |
+
+ The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where "shared" caching servers such as "proxy" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
+
+ |
+
+
+ |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/ |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234. |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/robots.txt |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234. |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/sitemap.xml |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234. |
+
+
+
+ | Instances |
+
+
+ 3 |
+
+
+
+ | Solution |
+
+ Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
+
+
+ Cache-Control: no-cache, no-store, must-revalidate, private
+
+
+ Pragma: no-cache
+
+
+ Expires: 0
+
+
+ This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
+
+ |
+
+
+ | Reference |
+
+ https://datatracker.ietf.org/doc/html/rfc7234
+
+
+ https://datatracker.ietf.org/doc/html/rfc7231
+
+
+ https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
+
+ |
+
+
+ | CWE Id |
+ 524 |
+
+
+ | WASC Id |
+ 13 |
+
+
+ | Plugin Id |
+ 10049 |
+
+
+
+
+
+
+
+
+ Sequence Details
+ With the associated active scan results.
+
+
+
+
+
+
+
+
+
+
+
diff --git a/lab9-artifacts/zap-baseline-after.json b/lab9-artifacts/zap-baseline-after.json
new file mode 100644
index 000000000..419e61843
--- /dev/null
+++ b/lab9-artifacts/zap-baseline-after.json
@@ -0,0 +1,99 @@
+{
+ "@programName": "ZAP",
+ "@version": "2.16.1",
+ "@generated": "Tue, 7 Jul 2026 20:10:16",
+ "created": "2026-07-07T20:10:16.947296149Z",
+ "site":[
+ {
+ "@name": "http://127.0.0.1:8080",
+ "@host": "127.0.0.1",
+ "@port": "8080",
+ "@ssl": "false",
+ "alerts": [
+ {
+ "pluginid": "10116",
+ "alertRef": "10116",
+ "alert": "ZAP is Out of Date",
+ "name": "ZAP is Out of Date",
+ "riskcode": "1",
+ "confidence": "3",
+ "riskdesc": "Low (High)",
+ "desc": "The version of ZAP you are using to test your app is out of date and is no longer being updated.
The risk level is set based on how out of date your ZAP version is.
",
+ "instances":[
+ {
+ "id": "1",
+ "uri": "http://127.0.0.1:8080/robots.txt",
+ "nodeName": null,
+ "method": "GET",
+ "param": "",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "The latest version of ZAP is 2.17.0"
+ }
+ ],
+ "count": "1",
+ "systemic": false,
+ "solution": "Download the latest version of ZAP from https://www.zaproxy.org/download/ and install it.
",
+ "otherinfo": "The latest version of ZAP is 2.17.0
",
+ "reference": "https://www.zaproxy.org/download/
",
+ "cweid": "1104",
+ "wascid": "45",
+ "sourceid": "6"
+ },
+ {
+ "pluginid": "10049",
+ "alertRef": "10049-3",
+ "alert": "Storable and Cacheable Content",
+ "name": "Storable and Cacheable Content",
+ "riskcode": "0",
+ "confidence": "2",
+ "riskdesc": "Informational (Medium)",
+ "desc": "The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where \"shared\" caching servers such as \"proxy\" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
",
+ "instances":[
+ {
+ "id": "0",
+ "uri": "http://127.0.0.1:8080/",
+ "nodeName": null,
+ "method": "GET",
+ "param": "",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234."
+ },
+ {
+ "id": "2",
+ "uri": "http://127.0.0.1:8080/robots.txt",
+ "nodeName": null,
+ "method": "GET",
+ "param": "",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234."
+ },
+ {
+ "id": "4",
+ "uri": "http://127.0.0.1:8080/sitemap.xml",
+ "nodeName": null,
+ "method": "GET",
+ "param": "",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234."
+ }
+ ],
+ "count": "3",
+ "systemic": false,
+ "solution": "Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
Expires: 0
This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
",
+ "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.
",
+ "reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
",
+ "cweid": "524",
+ "wascid": "13",
+ "sourceid": "1"
+ }
+ ]
+ }
+ ],
+ "sequences":[
+ ]
+
+}
diff --git a/lab9-artifacts/zap-baseline-before.html b/lab9-artifacts/zap-baseline-before.html
new file mode 100644
index 000000000..0face458d
--- /dev/null
+++ b/lab9-artifacts/zap-baseline-before.html
@@ -0,0 +1,903 @@
+
+
+
+
+ZAP Scanning Report
+
+
+
+
+
+
+ ZAP Scanning Report
+
+
+
+
+
+
+ Site: http://127.0.0.1:8080
+
+
+
+
+ Generated on Tue, 7 Jul 2026 20:09:29
+
+
+
+ ZAP Version: 2.16.1
+
+
+
+
+
+
+
+
+ | Risk Level |
+ Number of Alerts |
+
+
+ |
+ High
+ |
+
+ 0
+ |
+
+
+ |
+ Medium
+ |
+
+ 0
+ |
+
+
+ |
+ Low
+ |
+
+ 3
+ |
+
+
+ |
+ Informational
+ |
+
+ 1
+ |
+
+
+ |
+ False Positives:
+ |
+
+ 0
+ |
+
+
+
+
+
+
+
+ Summary of Sequences
+ For each step: result (Pass/Fail) - risk (of highest alert(s) for the step, if any).
+
+
+
+
+
+
+ Alerts
+
+
+
+
+
+ Alert Detail
+
+
+
+ |
+ Low |
+ Insufficient Site Isolation Against Spectre Vulnerability |
+
+
+ | Description |
+
+ Cross-Origin-Resource-Policy header is an opt-in header designed to counter side-channels attacks like Spectre. Resource should be specifically set as shareable amongst different origins.
+
+ |
+
+
+ |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/ |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ Cross-Origin-Resource-Policy |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/robots.txt |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ Cross-Origin-Resource-Policy |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/sitemap.xml |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ Cross-Origin-Resource-Policy |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ |
+
+
+
+ | Instances |
+
+
+ 3 |
+
+
+
+ | Solution |
+
+ Ensure that the application/web server sets the Cross-Origin-Resource-Policy header appropriately, and that it sets the Cross-Origin-Resource-Policy header to 'same-origin' for all web pages.
+
+
+ 'same-site' is considered as less secured and should be avoided.
+
+
+ If resources must be shared, set the header to 'cross-origin'.
+
+
+ If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Resource-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-resource-policy).
+
+ |
+
+
+ | Reference |
+
+ https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
+
+ |
+
+
+ | CWE Id |
+ 693 |
+
+
+ | WASC Id |
+ 14 |
+
+
+ | Plugin Id |
+ 90004 |
+
+
+
+
+
+
+ |
+ Low |
+ X-Content-Type-Options Header Missing |
+
+
+ | Description |
+
+ The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.
+
+ |
+
+
+ |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/ |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ x-content-type-options |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.
+At "High" threshold this scan rule will not alert on client or server error responses. |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/sitemap.xml |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ x-content-type-options |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.
+At "High" threshold this scan rule will not alert on client or server error responses. |
+
+
+
+ | Instances |
+
+
+ 2 |
+
+
+
+ | Solution |
+
+ Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.
+
+
+ If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
+
+ |
+
+
+ | Reference |
+
+ https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)
+
+
+ https://owasp.org/www-community/Security_Headers
+
+ |
+
+
+ | CWE Id |
+ 693 |
+
+
+ | WASC Id |
+ 15 |
+
+
+ | Plugin Id |
+ 10021 |
+
+
+
+
+
+
+ |
+ Low |
+ ZAP is Out of Date |
+
+
+ | Description |
+
+ The version of ZAP you are using to test your app is out of date and is no longer being updated.
+
+
+ The risk level is set based on how out of date your ZAP version is.
+
+ |
+
+
+ |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/robots.txt |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ The latest version of ZAP is 2.17.0 |
+
+
+
+ | Instances |
+
+
+ 1 |
+
+
+
+ | Solution |
+
+ Download the latest version of ZAP from https://www.zaproxy.org/download/ and install it.
+
+ |
+
+
+ | Reference |
+
+ https://www.zaproxy.org/download/
+
+ |
+
+
+ | CWE Id |
+ 1104 |
+
+
+ | WASC Id |
+ 45 |
+
+
+ | Plugin Id |
+ 10116 |
+
+
+
+
+
+
+ |
+ Informational |
+ Storable and Cacheable Content |
+
+
+ | Description |
+
+ The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where "shared" caching servers such as "proxy" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
+
+ |
+
+
+ |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/ |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234. |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/robots.txt |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234. |
+
+
+
+ | URL |
+ http://127.0.0.1:8080/sitemap.xml |
+
+
+
+ | Method |
+ GET |
+
+
+ | Parameter |
+ |
+
+
+ | Attack |
+ |
+
+
+ | Evidence |
+ |
+
+
+ | Other Info |
+ In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234. |
+
+
+
+ | Instances |
+
+
+ 3 |
+
+
+
+ | Solution |
+
+ Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
+
+
+ Cache-Control: no-cache, no-store, must-revalidate, private
+
+
+ Pragma: no-cache
+
+
+ Expires: 0
+
+
+ This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
+
+ |
+
+
+ | Reference |
+
+ https://datatracker.ietf.org/doc/html/rfc7234
+
+
+ https://datatracker.ietf.org/doc/html/rfc7231
+
+
+ https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
+
+ |
+
+
+ | CWE Id |
+ 524 |
+
+
+ | WASC Id |
+ 13 |
+
+
+ | Plugin Id |
+ 10049 |
+
+
+
+
+
+
+
+
+ Sequence Details
+ With the associated active scan results.
+
+
+
+
+
+
+
+
+
+
+
diff --git a/lab9-artifacts/zap-baseline-before.json b/lab9-artifacts/zap-baseline-before.json
new file mode 100644
index 000000000..378a3daec
--- /dev/null
+++ b/lab9-artifacts/zap-baseline-before.json
@@ -0,0 +1,189 @@
+{
+ "@programName": "ZAP",
+ "@version": "2.16.1",
+ "@generated": "Tue, 7 Jul 2026 20:09:29",
+ "created": "2026-07-07T20:09:29.662003544Z",
+ "site":[
+ {
+ "@name": "http://127.0.0.1:8080",
+ "@host": "127.0.0.1",
+ "@port": "8080",
+ "@ssl": "false",
+ "alerts": [
+ {
+ "pluginid": "90004",
+ "alertRef": "90004-1",
+ "alert": "Insufficient Site Isolation Against Spectre Vulnerability",
+ "name": "Insufficient Site Isolation Against Spectre Vulnerability",
+ "riskcode": "1",
+ "confidence": "2",
+ "riskdesc": "Low (Medium)",
+ "desc": "Cross-Origin-Resource-Policy header is an opt-in header designed to counter side-channels attacks like Spectre. Resource should be specifically set as shareable amongst different origins.
",
+ "instances":[
+ {
+ "id": "5",
+ "uri": "http://127.0.0.1:8080/",
+ "nodeName": null,
+ "method": "GET",
+ "param": "Cross-Origin-Resource-Policy",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": ""
+ },
+ {
+ "id": "6",
+ "uri": "http://127.0.0.1:8080/robots.txt",
+ "nodeName": null,
+ "method": "GET",
+ "param": "Cross-Origin-Resource-Policy",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": ""
+ },
+ {
+ "id": "12",
+ "uri": "http://127.0.0.1:8080/sitemap.xml",
+ "nodeName": null,
+ "method": "GET",
+ "param": "Cross-Origin-Resource-Policy",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": ""
+ }
+ ],
+ "count": "3",
+ "systemic": false,
+ "solution": "Ensure that the application/web server sets the Cross-Origin-Resource-Policy header appropriately, and that it sets the Cross-Origin-Resource-Policy header to 'same-origin' for all web pages.
'same-site' is considered as less secured and should be avoided.
If resources must be shared, set the header to 'cross-origin'.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Resource-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-resource-policy).
",
+ "otherinfo": "",
+ "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
",
+ "cweid": "693",
+ "wascid": "14",
+ "sourceid": "1"
+ },
+ {
+ "pluginid": "10021",
+ "alertRef": "10021",
+ "alert": "X-Content-Type-Options Header Missing",
+ "name": "X-Content-Type-Options Header Missing",
+ "riskcode": "1",
+ "confidence": "2",
+ "riskdesc": "Low (Medium)",
+ "desc": "The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.
",
+ "instances":[
+ {
+ "id": "0",
+ "uri": "http://127.0.0.1:8080/",
+ "nodeName": null,
+ "method": "GET",
+ "param": "x-content-type-options",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses."
+ },
+ {
+ "id": "8",
+ "uri": "http://127.0.0.1:8080/sitemap.xml",
+ "nodeName": null,
+ "method": "GET",
+ "param": "x-content-type-options",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses."
+ }
+ ],
+ "count": "2",
+ "systemic": false,
+ "solution": "Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.
If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
",
+ "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.
At \"High\" threshold this scan rule will not alert on client or server error responses.
",
+ "reference": "https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)
https://owasp.org/www-community/Security_Headers
",
+ "cweid": "693",
+ "wascid": "15",
+ "sourceid": "1"
+ },
+ {
+ "pluginid": "10116",
+ "alertRef": "10116",
+ "alert": "ZAP is Out of Date",
+ "name": "ZAP is Out of Date",
+ "riskcode": "1",
+ "confidence": "3",
+ "riskdesc": "Low (High)",
+ "desc": "The version of ZAP you are using to test your app is out of date and is no longer being updated.
The risk level is set based on how out of date your ZAP version is.
",
+ "instances":[
+ {
+ "id": "2",
+ "uri": "http://127.0.0.1:8080/robots.txt",
+ "nodeName": null,
+ "method": "GET",
+ "param": "",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "The latest version of ZAP is 2.17.0"
+ }
+ ],
+ "count": "1",
+ "systemic": false,
+ "solution": "Download the latest version of ZAP from https://www.zaproxy.org/download/ and install it.
",
+ "otherinfo": "The latest version of ZAP is 2.17.0
",
+ "reference": "https://www.zaproxy.org/download/
",
+ "cweid": "1104",
+ "wascid": "45",
+ "sourceid": "6"
+ },
+ {
+ "pluginid": "10049",
+ "alertRef": "10049-3",
+ "alert": "Storable and Cacheable Content",
+ "name": "Storable and Cacheable Content",
+ "riskcode": "0",
+ "confidence": "2",
+ "riskdesc": "Informational (Medium)",
+ "desc": "The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where \"shared\" caching servers such as \"proxy\" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
",
+ "instances":[
+ {
+ "id": "3",
+ "uri": "http://127.0.0.1:8080/",
+ "nodeName": null,
+ "method": "GET",
+ "param": "",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234."
+ },
+ {
+ "id": "4",
+ "uri": "http://127.0.0.1:8080/robots.txt",
+ "nodeName": null,
+ "method": "GET",
+ "param": "",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234."
+ },
+ {
+ "id": "9",
+ "uri": "http://127.0.0.1:8080/sitemap.xml",
+ "nodeName": null,
+ "method": "GET",
+ "param": "",
+ "attack": "",
+ "evidence": "",
+ "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234."
+ }
+ ],
+ "count": "3",
+ "systemic": false,
+ "solution": "Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
Expires: 0
This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
",
+ "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.
",
+ "reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
",
+ "cweid": "524",
+ "wascid": "13",
+ "sourceid": "1"
+ }
+ ]
+ }
+ ],
+ "sequences":[
+ ]
+
+}
diff --git a/lab9-artifacts/zap-openapi.yaml b/lab9-artifacts/zap-openapi.yaml
new file mode 100644
index 000000000..ff73d8563
--- /dev/null
+++ b/lab9-artifacts/zap-openapi.yaml
@@ -0,0 +1,31 @@
+openapi: 3.0.3
+info:
+ title: QuickNotes
+ version: "1.0"
+servers:
+ - url: http://127.0.0.1:8080
+paths:
+ /:
+ get:
+ responses:
+ "200":
+ description: root
+ /health:
+ get:
+ responses:
+ "200":
+ description: health
+ /notes:
+ get:
+ responses:
+ "200":
+ description: list notes
+ post:
+ responses:
+ "201":
+ description: create note
+ /metrics:
+ get:
+ responses:
+ "200":
+ description: metrics
diff --git a/lab9-artifacts/zap.yaml b/lab9-artifacts/zap.yaml
new file mode 100644
index 000000000..d6dd16fd3
--- /dev/null
+++ b/lab9-artifacts/zap.yaml
@@ -0,0 +1,40 @@
+env:
+ contexts:
+ - excludePaths: []
+ name: baseline
+ urls:
+ - http://127.0.0.1:8080/
+ parameters:
+ failOnError: true
+ progressToStdout: false
+jobs:
+- parameters:
+ enableTags: false
+ maxAlertsPerRule: 10
+ type: passiveScan-config
+- parameters:
+ maxDuration: 1
+ url: http://127.0.0.1:8080/
+ type: spider
+- parameters:
+ maxDuration: 0
+ type: passiveScan-wait
+- parameters:
+ format: Short
+ summaryFile: /home/zap/zap_out.json
+ rules: []
+ type: outputSummary
+- parameters:
+ reportDescription: ''
+ reportDir: /zap/wrk/
+ reportFile: zap-baseline-after.html
+ reportTitle: ZAP Scanning Report
+ template: traditional-html
+ type: report
+- parameters:
+ reportDescription: ''
+ reportDir: /zap/wrk/
+ reportFile: zap-baseline-after.json
+ reportTitle: ZAP Scanning Report
+ template: traditional-json
+ type: report
diff --git a/submissions/lab10.md b/submissions/lab10.md
new file mode 100644
index 000000000..c0e7bdf5b
--- /dev/null
+++ b/submissions/lab10.md
@@ -0,0 +1,90 @@
+# Lab 10 Submission β QuickNotes to Cloud
+
+## Task 1 β CI release β ghcr.io (push on tag)
+
+### Release workflow
+File: `.github/workflows/release.yml`
+
+Workflow details:
+- Triggers on tag `v*`
+- Builds image from `app/`
+- Pushes to `ghcr.io/ilyapechersky/devops-intro/quicknotes` with tags `${GITHUB_REF_NAME}` and `latest`
+- Actions are SHA-pinned
+
+### Evidence: tag β CI success
+Release run (tag `v0.1.1`):
+- https://github.com/IlyaPechersky/DevOps-Intro/actions/runs/28951114199
+
+### Registry URL
+- Image: `ghcr.io/ilyapechersky/devops-intro/quicknotes:v0.1.1`
+
+### Evidence: clean pull
+On the course VM server:
+```text
+$ docker pull ghcr.io/ilyapechersky/devops-intro/quicknotes:v0.1.1
+Status: Downloaded newer image for ghcr.io/ilyapechersky/devops-intro/quicknotes:v0.1.1
+```
+
+Design questions:
+- a) In-repo push to GHCR can be done with `GITHUB_TOKEN` (scoped to `packages: write`). OIDC is useful when you want to avoid long-lived tokens or when pushing to a different account/registry with stronger trust.
+- b) `:latest` is a convenience pointer for humans and some tooling, while immutable `:vX.Y.Z` tags make releases reproducible and auditable.
+- c) Narrow `packages: write` prevents an attacker from doing unrelated writes (`write: all`) like modifying repo content.
+
+---
+
+## Task 2 β Hugging Face Spaces (Docker SDK)
+
+I attempted to create a public Docker Space on Hugging Face with the Docker SDK.
+
+### Attempt result (blocked)
+HF API error when creating Docker Space:
+- `Static Spaces are free for everyone, but hosting Gradio and Docker Spaces on free cpu-basic requires a PRO subscription.`
+
+I also checked the account capability via `whoami-v2`:
+- `isPro=false`.
+
+Because the account is not PRO and paid hardware requires pre-paid credits, I could not complete Task 2 (create the Space + measure warm/cold latency).
+
+Artifacts prepared in this repo (for when the Space can be created):
+- `cloud/Dockerfile`
+- `cloud/README.md` (Spaces YAML frontmatter includes `sdk: docker` and `app_port: 8080`)
+
+Design questions:
+- d) (unanswered due to blocked Space creation)
+- e) (unanswered due to blocked Space creation)
+- f) (unanswered due to blocked Space creation)
+
+---
+
+## Bonus β Cloudflare Tunnel (public URL + latency)
+
+### Quick tunnel URL
+From server logs after running `cloudflared`:
+- `https://investigators-martial-series-insert.trycloudflare.com/health`
+
+### Reachability check
+The tunnel served QuickNotes health successfully:
+- `{"status":"ok","notes":0}` (after container start)
+
+### Warm latency measurement (50 requests)
+Measurement method: 50 sequential GET requests with Python `urllib.request` and recording wall-clock time.
+
+Results:
+- p50: ~190 ms
+- p95: ~236 ms
+
+Cold start is not applicable to the Tunnel comparison here because the container is continuously running locally for the measurement.
+
+Comparison table (measured):
+| Metric | HF Spaces (hosted) | Cloudflare Tunnel (local-via-edge) |
+|--------|-------------------:|-----------------------------------:|
+| Warm p50 | N/A (blocked) | 190 ms |
+| Warm p95 | N/A (blocked) | 236 ms |
+| Cold start | N/A | N/A |
+| Public URL stability | N/A | Ephemeral per restart |
+| Cost | N/A | free |
+
+Design questions:
+- g) HF runs the container in their datacenter; Tunnel proxies traffic from your local container via Cloudflareβs edge. For users, both are βhosted URLsβ, but operationally Tunnel is closer to local deployments with remote exposure.
+- h) For Tunnel, the warm latency is dominated by request path (client β Cloudflare edge β your server) and your serverβs response time. For hosted HF, warm latency dominator is usually platform routing + container/service startup overhead.
+- i) Tunnel is good for local dev, demos, and exposing stakeholder URLs from home/on-prem; itβs usually not ideal for production unless you accept your laptop/on-prem as the origin.
diff --git a/submissions/lab6.md b/submissions/lab6.md
new file mode 100644
index 000000000..0119dddbf
--- /dev/null
+++ b/submissions/lab6.md
@@ -0,0 +1,205 @@
+# Lab 6 Submission
+
+Host used for the run: Ubuntu 24.04.3 LTS x86_64 cloud server with Docker 29.4.2 and Compose v5.1.3.
+
+## Task 1 - Multi-Stage Dockerfile
+
+`app/Dockerfile` is committed in the repository. Key points:
+
+- Builder: `golang:1.24-alpine`
+- Runtime: `gcr.io/distroless/static-debian12:nonroot`
+- Static build with `CGO_ENABLED=0`, `-trimpath`, `-ldflags='-s -w'`
+- `USER nonroot:nonroot`, `EXPOSE 8080`, exec-form `ENTRYPOINT`
+- `go.mod` copied before source for layer caching
+- A tiny static `/healthcheck` binary is built in the builder stage for HTTP probes
+- `/data` is seeded in the image with UID 65532 so named volumes inherit writable ownership
+
+Build and image size:
+
+```text
+$ docker build -t quicknotes:lab6 ./app
+...
+$ docker images quicknotes:lab6
+IMAGE ID DISK USAGE CONTENT SIZE EXTRA
+quicknotes:lab6 f63a1637227a 22.5MB 5.6MB
+
+$ docker images golang:1.24-alpine
+IMAGE ID DISK USAGE CONTENT SIZE EXTRA
+golang:1.24-alpine 8bee1901f1e5 395MB 83.5MB
+```
+
+`docker inspect` excerpt:
+
+```text
+User=nonroot:nonroot
+ExposedPorts={"8080/tcp":{}}
+Entrypoint=["/quicknotes"]
+Healthcheck={"Test":["CMD","/healthcheck"],"Interval":10000000000,"Timeout":3000000000,"StartPeriod":5000000000,"Retries":3}
+```
+
+Runtime verification:
+
+```text
+$ docker run -d --name qn-lab6-run -p 18081:8080 \
+ -e ADDR=0.0.0.0:8080 -e DATA_PATH=/data/notes.json -e SEED_PATH=/seed.json \
+ -v qn-lab6-run-data:/data quicknotes:lab6
+$ curl -s http://127.0.0.1:18081/health
+{"notes":4,"status":"ok"}
+```
+
+### Layer-cache comparison
+
+Bad order (`COPY . .` before `go mod download`), rebuild after touching one source file:
+
+```text
+#10 [builder 4/5] RUN go mod download
+#12 [builder 5/5] RUN CGO_ENABLED=0 ... go build ...
+real 0.72
+```
+
+Good order (`COPY go.mod` + `go mod download` before `COPY . .`), rebuild after the same change:
+
+```text
+#20 [builder 5/9] RUN go mod download
+#20 CACHED
+#17 [builder 7/9] RUN CGO_ENABLED=0 ... go build ...
+real 1.30
+```
+
+The bad Dockerfile invalidates dependency download on every source edit. The good Dockerfile keeps `go mod download` cached and only rebuilds the binary layer.
+
+### Design answers
+
+a) Layer order matters because Docker caches each instruction. Putting `COPY . .` before `go mod download` ties the dependency layer to every source change, so `go mod download` reruns even when `go.mod` is unchanged. Copying `go.mod` first keeps dependency download cached across normal code edits.
+
+b) `CGO_ENABLED=0` produces a fully static binary with no libc dependency. Distroless static has no dynamic linker; a CGO-enabled binary fails at startup with errors like `no such file or directory` when the loader is missing.
+
+c) `gcr.io/distroless/static:nonroot` is a minimal runtime image with just the app, CA certs, `/etc/passwd`, and timezone data. It has no shell, package manager, or extra utilities. Fewer packages means a much smaller attack surface and fewer OS-level CVEs to patch.
+
+d) `-s -w` strips the symbol table and DWARF debug info to shrink the binary. `-trimpath` removes local filesystem paths from the binary for reproducible builds. The cost is harder post-mortem debugging from the stripped binary alone.
+
+## Task 2 - Compose + Healthcheck + Persistent Volume
+
+Root `compose.yaml`:
+
+```yaml
+services:
+ quicknotes:
+ build:
+ context: ./app
+ dockerfile: Dockerfile
+ image: quicknotes:lab6
+ ports:
+ - "8080:8080"
+ environment:
+ ADDR: "0.0.0.0:8080"
+ DATA_PATH: "/data/notes.json"
+ SEED_PATH: "/seed.json"
+ volumes:
+ - quicknotes-data:/data
+ restart: unless-stopped
+ cap_drop:
+ - ALL
+ read_only: true
+ tmpfs:
+ - /tmp
+ security_opt:
+ - no-new-privileges:true
+ healthcheck:
+ test: ["CMD", "/healthcheck"]
+ interval: 10s
+ timeout: 3s
+ retries: 3
+ start_period: 5s
+
+volumes:
+ quicknotes-data:
+```
+
+Persistence test:
+
+```text
+$ docker compose up --build -d
+$ curl -s http://127.0.0.1:8080/health
+{"notes":4,"status":"ok"}
+
+$ curl -s -X POST -H 'Content-Type: application/json' \
+ -d '{"title":"durable","body":"survive a restart"}' \
+ http://127.0.0.1:8080/notes
+{"id":5,"title":"durable","body":"survive a restart","created_at":"2026-06-23T20:27:39.237347063Z"}
+
+--- after POST ---
+$ curl -s http://127.0.0.1:8080/notes | grep durable
+..."title":"durable"...
+
+$ docker compose down
+$ docker compose up -d
+
+--- after down/up ---
+$ curl -s http://127.0.0.1:8080/notes | grep durable
+..."title":"durable"...
+
+$ docker compose down -v
+$ docker compose up -d
+
+--- after down -v ---
+durable gone (expected)
+```
+
+Compose status after startup:
+
+```text
+NAME IMAGE STATUS PORTS
+devops-lab6-quicknotes-1 quicknotes:lab6 Up 12 seconds (healthy) 0.0.0.0:8080->8080/tcp
+```
+
+### Design answers
+
+e) Distroless has no shell, so a shell-form healthcheck cannot work. I built a tiny static `/healthcheck` binary in the builder stage and use exec-form `CMD ["/healthcheck"]` to call `http://127.0.0.1:8080/health`. That gives a real HTTP probe without adding a shell to the runtime image.
+
+f) `volumes: [quicknotes-data:/data]` survives `docker compose down` because Compose removes containers and networks, not named volumes. The data stays in Docker's volume store until `docker compose down -v`, `docker volume rm`, or `docker volume prune`.
+
+g) `depends_on` without `condition: service_healthy` only waits for the dependency container to start, not for the app inside it to be ready. A dependent service can send traffic before QuickNotes is listening and see connection errors.
+
+## Bonus - 6 Security Defaults
+
+Hardened `services.quicknotes` block is shown above (`cap_drop`, `read_only`, `tmpfs`, `security_opt`, nonroot image, distroless base).
+
+Verification:
+
+```text
+$ docker inspect quicknotes:lab6 --format '{{ .Config.User }}'
+nonroot:nonroot
+
+$ docker compose exec quicknotes sh
+OCI runtime exec failed: exec failed: unable to start container process: exec: "sh": executable file not found in $PATH
+
+$ docker inspect --format '{{ .HostConfig.CapDrop }}'
+[ALL]
+
+$ docker inspect --format '{{ .HostConfig.ReadonlyRootfs }}'
+true
+
+$ docker inspect --format '{{ .HostConfig.SecurityOpt }}'
+[no-new-privileges:true]
+
+$ docker inspect --format '{{json .State.Health.Status}}'
+"healthy"
+```
+
+Read-only root was also confirmed via `ReadonlyRootfs=true`; there is no shell in the runtime image to run `touch /etc/test` inside the container itself.
+
+Trivy scan:
+
+```text
+$ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
+ aquasec/trivy:0.59.1 image --severity HIGH,CRITICAL --no-progress \
+ quicknotes:lab6
+
+quicknotes:lab6 (debian 12.14)
+Total: 0 (HIGH: 0, CRITICAL: 0)
+```
+
+Trivy also reported Go stdlib findings inside the compiled binaries; the distroless OS layer itself had zero HIGH/CRITICAL findings.
+
+The best security-per-line default here is `cap_drop: [ALL]`. It removes Linux capabilities from the container process namespace with one YAML line and directly reduces kernel-level escape options. Distroless and nonroot matter a lot too, but capability dropping is the clearest enforcement knob in Compose.
diff --git a/submissions/lab9.md b/submissions/lab9.md
new file mode 100644
index 000000000..425225bc2
--- /dev/null
+++ b/submissions/lab9.md
@@ -0,0 +1,214 @@
+# Lab 9 Submission
+
+Host used for the run: Ubuntu 24.04.3 LTS x86_64 cloud server with Docker 29.4.2. Scanners: Trivy `0.59.1`, ZAP `2.16.1`.
+
+## Task 1 - Trivy Scans + SBOM
+
+### Image scan (`trivy image quicknotes:lab6`)
+
+```text
+quicknotes:lab6 (debian 12.14)
+Total: 0 (HIGH: 0, CRITICAL: 0)
+
+healthcheck (gobinary)
+Total: 11 (HIGH: 11, CRITICAL: 0)
+
+quicknotes (gobinary)
+Total: 11 (HIGH: 11, CRITICAL: 0)
+```
+
+Full output: `lab9-artifacts/trivy-image.txt`.
+
+### Filesystem scan (`trivy fs`)
+
+```text
+$ trivy fs --severity HIGH,CRITICAL /repo
+(no HIGH/CRITICAL findings)
+```
+
+Full output: `lab9-artifacts/trivy-fs.txt`.
+
+### Config scan (`trivy config`)
+
+```text
+$ trivy config --severity HIGH,CRITICAL /repo
+(no HIGH/CRITICAL misconfigurations)
+```
+
+Full output: `lab9-artifacts/trivy-config.txt`.
+
+### SBOM (`trivy image --format cyclonedx`)
+
+First lines of `lab9-artifacts/quicknotes.sbom.cdx.json`:
+
+```json
+{
+ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+ "bomFormat": "CycloneDX",
+ "specVersion": "1.6",
+ "serialNumber": "urn:uuid:4ee1a9b4-26cd-47e7-a4ef-d586c2403124",
+ "version": 1,
+ "metadata": {
+ "timestamp": "2026-07-07T20:15:26+00:00",
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "0.59.1"
+ }
+ ]
+ },
+ "component": {
+ "type": "container",
+ "name": "quicknotes:lab6"
+ }
+ }
+}
+```
+
+### Trivy triage (HIGH/CRITICAL)
+
+| Finding | Severity | Disposition | Reason |
+|---------|----------|-------------|--------|
+| Debian 12.14 OS packages in `quicknotes:lab6` image | HIGH/CRITICAL | N/A | Trivy reported `0` OS-layer HIGH/CRITICAL on distroless runtime |
+| Go stdlib CVEs in `quicknotes` binary (11 HIGH, e.g. CVE-2026-33811, CVE-2026-42504) | HIGH | WATCH | Findings are in the compiled stdlib inside the static binary; Trivy marks several as `fixed` in newer Go releases. Re-check on next image rebuild after bumping builder Go patch version |
+| Go stdlib CVEs in `healthcheck` binary (11 HIGH) | HIGH | ACCEPT | Auxiliary probe binary is not exposed as a service; same stdlib scanner noise as main binary. Re-evaluate by 2026-12-31 |
+
+### Design answers
+
+a) CVE severity alone is not enough. I also consider reachability (is the vulnerable code path used?), exploit availability, deployment exposure (internal API vs public internet), and blast radius if compromised.
+
+b) Distroless removes shells, package managers, and most OS packages, so the runtime image has almost nothing left to patch. That is the strongest single control here because it eliminates whole classes of OS CVEs before triage even starts.
+
+c) `.trivyignore` is right for documented, time-bounded risk acceptance with an owner and re-check date. It is theater when it permanently hides findings that should be fixed or upgraded.
+
+d) The SBOM answers "are we affected by CVE-X?" without rebuilding or guessing. During incidents like Log4Shell, you can query the SBOM for the component name/version instead of auditing every image by hand.
+
+## Task 2 - ZAP Baseline + Security Header Fix
+
+ZAP command:
+
+```bash
+docker run --rm --network host \
+ -v "$PWD/lab9-artifacts:/zap/wrk:rw" \
+ ghcr.io/zaproxy/zaproxy:2.16.1 \
+ zap-baseline.py -t http://127.0.0.1:8080/ \
+ -r zap-baseline-before.html -J zap-baseline-before.json -I
+```
+
+### ZAP triage
+
+| ID | Name | Risk | Disposition | Reason |
+|----|------|------|-------------|--------|
+| 10021 | X-Content-Type-Options Header Missing | Low | FIX | Added `securityHeaders` middleware |
+| 90004 | Insufficient Site Isolation Against Spectre Vulnerability | Low | FIX | Added `Cross-Origin-Opener-Policy` and `Cross-Origin-Resource-Policy` |
+| 10049 | Storable and Cacheable Content | Informational | ACCEPT | JSON API responses without sensitive session state; acceptable for this lab API. Re-evaluate by 2026-12-31 |
+| 10116 | ZAP is Out of Date | Low | FALSE POSITIVE | Scanner container version warning, not a QuickNotes application defect |
+
+### Code fix
+
+Added `app/security.go` middleware and wrapped the router in `app/main.go`:
+
+```go
+Handler: securityHeaders(server.Routes()),
+```
+
+Headers set on every route: `X-Content-Type-Options`, `X-Frame-Options`, `Content-Security-Policy`, `Referrer-Policy`, `Permissions-Policy`, `Cross-Origin-Opener-Policy`, `Cross-Origin-Resource-Policy`.
+
+Unit test `TestSecurityHeaders_OnAllRoutes` in `app/security_test.go` asserts the headers on `/`, `/health`, `/notes`, and `/metrics`.
+
+### Before / after evidence
+
+Headers before fix:
+
+```text
+$ curl -sI http://127.0.0.1:8080/
+HTTP/1.1 200 OK
+Content-Type: application/json
+Date: Tue, 07 Jul 2026 20:08:57 GMT
+```
+
+Headers after fix:
+
+```text
+$ curl -sI http://127.0.0.1:8080/
+HTTP/1.1 200 OK
+Content-Security-Policy: default-src 'none'; frame-ancestors 'none'
+X-Content-Type-Options: nosniff
+X-Frame-Options: DENY
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Resource-Policy: same-origin
+```
+
+ZAP summary:
+
+| Report | Plugin 10021 | Plugin 90004 | Other warnings |
+|--------|--------------|--------------|----------------|
+| `zap-baseline-before.json` | present | present | 10049, 10116 |
+| `zap-baseline-after.json` | absent | absent | 10049, 10116 |
+
+Artifacts: `lab9-artifacts/zap-baseline-before.{html,json}`, `lab9-artifacts/zap-baseline-after.{html,json}`.
+
+### Design answers
+
+e) Middleware applies one policy to every handler in a single place. Per-handler header code drifts quickly and is easy to forget on new endpoints.
+
+f) `Content-Security-Policy: default-src 'none'` blocks browsers from loading scripts, styles, or images. That is fine for a JSON API with no HTML UI, but it would break a normal website that needs assets from its own origin or a CDN.
+
+g) Marking every informational ZAP alert as accepted without reading them creates alert fatigue and hides real regressions later. You lose the signal that something actually changed.
+
+## Bonus - govulncheck CI Gate
+
+Added a `govulncheck` job to `.github/workflows/ci.yml`:
+
+```yaml
+ govulncheck:
+ name: govulncheck
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+ - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
+ with:
+ go-version: "1.24"
+ cache: true
+ cache-dependency-path: app/go.mod
+ - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
+ - run: govulncheck ./...
+ working-directory: app
+```
+
+### Red / green demonstration
+
+Green run on the submitted code (`lab9-artifacts/govulncheck-green.txt`):
+
+```text
+No vulnerabilities found.
+```
+
+Red demonstration: temporarily added `golang.org/x/crypto@v0.12.0` and a probe import, then ran `govulncheck -show verbose ./...` (`lab9-artifacts/govulncheck-red-verbose.txt`):
+
+```text
+=== Module Results ===
+
+Vulnerability #1: GO-2026-5033
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+
+Vulnerability #2: GO-2026-5023
+ Module: golang.org/x/crypto
+ Found in: golang.org/x/crypto@v0.12.0
+ Fixed in: golang.org/x/crypto@v0.52.0
+```
+
+The vulnerable dependency was not committed; the final tree stays clean while the CI job blocks reachable Go vulnerabilities on every PR.
+
+### Design answers
+
+h) `govulncheck` distinguishes "module has a CVE" from "our code can reach the vulnerable symbol." That cuts triage noise: a vulnerable test dependency you never call is a different decision than a reachable TLS parser bug.
+
+i) Pinning the scanner version keeps CI reproducible. `@latest` can change rules or vulnerability data between runs and create false red/green flapping.
+
+j) `govulncheck` does not see OS packages, container base layers, or misconfigurations in `Dockerfile` / `compose.yaml`. Trivy image/config scans cover those layers.