feat(lab10): defectdojo governance report + capstone walkthrough

[m1d0rfeed]

Goal

This PR completes Lab 10 vulnerability management and governance using DefectDojo 2.58.4.

It consolidates findings from previous labs, demonstrates cross-tool deduplication, applies severity-based SLA targets, documents a time-bound Risk Acceptance, and provides a five-minute capstone walkthrough.

Results

• 382 raw finding records imported
• 380 canonical findings after cross-tool correlation
• 379 active canonical findings after Risk Acceptance
• 6 DefectDojo scan types exercised
• Cross-tool correlation documented for CVE-2026-5079
• Canonical Finding ID: 70
• Duplicate Finding IDs: 180, 363
• Critical SLA: 24 hours
• High SLA: 7 days
• Medium SLA: 30 days
• Low SLA: 90 days
• Risk Acceptance expiration: 2026-09-30
• Walkthrough practiced runtime: 4:36

Files

• submissions/lab10.md
• submissions/lab10-walkthrough.md

Notes

• The available ZAP report was JSON, while the installed DefectDojo ZAP parser expected XML. The failed import is documented rather than reported as successful.
• Lab 8 Cosign verification and Lab 9 Falco alerts are documented as security evidence because they are not directly compatible vulnerability-report formats.
• No API tokens, DefectDojo source files, or temporary import responses are committed.

PR checklist

• Task 1 — DefectDojo setup + imports + dedup proof
• Task 2 — Governance report with MTTD/MTTR/SLA/backlog
• Bonus — 5-minute walkthrough script with timed practice