feat(lab5): ZAP baseline + auth + Semgrep + correlation

[Philip-78]

Goal

Run DAST (ZAP unauthenticated + authenticated) and SAST (Semgrep) against Juice Shop, then correlate findings across both tools.

Changes

• submissions/lab5.md — ZAP baseline + auth scan tables, Semgrep top-10 rules, SAST/DAST correlation

Testing

• ZAP baseline: 10 unique alert types (no SQL Injection found)
• ZAP authenticated: 12 unique alert types including SQL Injection (High)
• Semgrep: 22 findings (12 ERROR, 10 WARNING) across 1000 files with 533 rules
• Correlated finding: SQL Injection confirmed by both express-sequelize-injection (Semgrep) and ZAP active scan on /rest/products/search

Artifacts & Screenshots

• submissions/lab5.md — full analysis

---

• Task 1 — ZAP baseline + auth + 10-20× ratio analysis
• Task 2 — Semgrep top-10 + triage shortcut + false positive sample
• Bonus — Correlation table with confirmed cross-tool SQL Injection finding