Lab 9: DevSecOps: Trivy + ZAP hardening of QuickNotes

[danielpancake]

Goal

Scan QuickNotes with Trivy and OWASP ZAP, fix security issues, and document all HIGH/CRITICAL findings

Changes

• Ran Trivy image, filesystem, and config scans; generated a CycloneDX SBOM
• Updated the build image to golang:1.26-alpine and added a Docker HEALTHCHECK
• Added securityHeaders middleware (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) with a unit test
• Ran an OWASP ZAP baseline scan and fixed the X-Content-Type-Options finding (10021)

Testing

• Trivy image scan: 11 HIGH → 0 HIGH; config scan passes
• go test ./... passes, including the security headers test
• ZAP scan: finding 10021 changed from WARN → PASS

Checklist

• Title is a clear sentence (≤70 chars)
• Commits are signed (git log --show-signature)
• submissions/lab9.md updated