feat(lab10): defectdojo governance report + capstone walkthrough

[StefFashka]

Goal

Run DefectDojo locally, import prior Lab 4-9 security scan outputs for OWASP Juice Shop, apply SLA/dedup governance, and add the Lab 10 capstone report plus interview walkthrough.

Changes

• submissions/lab10.md — added the Lab 10 governance report with DefectDojo setup details, import counts, dedup proof, SLA metrics, risk acceptance, and next-quarter SAMM goal.
• submissions/lab10-walkthrough.md — added the bonus 5-minute DevSecOps program walkthrough script.

Testing

docker compose ps
# Expected: DefectDojo services up: nginx, uwsgi, celeryworker, celerybeat, postgres, valkey

curl.exe -s -H "Authorization: Token $env:DD_TOKEN" `
  "http://localhost:8080/api/v2/products/" | jq .count
# Expected: 1

curl.exe -s -H "Authorization: Token $env:DD_TOKEN" `
  "http://localhost:8080/api/v2/engagements/" | jq .count
# Expected: 1

curl.exe -s -H "Authorization: Token $env:DD_TOKEN" `
  "http://localhost:8080/api/v2/findings/?engagement=1&limit=1" | jq .count
# Expected: 403 raw findings

curl.exe -s -H "Authorization: Token $env:DD_TOKEN" `
  "http://localhost:8080/api/v2/findings/?engagement=1&duplicate=true&limit=1" | jq .count
# Expected: 52 duplicates

curl.exe -s -H "Authorization: Token $env:DD_TOKEN" `
  "http://localhost:8080/api/v2/findings/?engagement=1&active=true&duplicate=false&limit=1" | jq .count
# Expected: 350 active open findings

Artifacts & Screenshots

Submission report: lab10.md
Walkthrough script: lab10-walkthrough.md

Required checklist:

• Task 1 — DefectDojo setup + imports + dedup proof
• Task 2 — Governance report with MTTD/MTTR/SLA/backlog
• Bonus — 5-minute walkthrough script with timed practice