Lab 9 Submission

[G-Akleh]

Goal

Add DevSecOps scanning to QuickNotes: triage all Trivy/ZAP findings, fix them in code, and gate the CI on reachable Go vulnerabilities.

Changes

• Trivy (Task 1): image + filesystem + config scans and a CycloneDX SBOM; every HIGH/CRITICAL triaged in submissions/lab9.md.
• Fixed 10 Go-stdlib HIGH CVEs by bumping the builder golang:1.24-alpine → golang:1.26-alpine; re-scan is 0 HIGH/CRITICAL.
• ZAP baseline (Task 2): every finding triaged; added a securityHeaders middleware wrapping the whole router (app/middleware.go) with a guard test, fixing X-Content-Type-Options (ZAP 10021 WARN→PASS).
• Bonus: govulncheck CI job (pinned @v1.1.4, Go 1.26 to match the shipped toolchain), wired into the ci-ok gate.

Testing

• go test ./... passes, including the new header test (fails if the middleware is removed).
• Trivy re-scan of the rebuilt image: Total: 0 (HIGH: 0, CRITICAL: 0).
• ZAP re-scan against /notes: X-Content-Type-Options [10021] moved WARN→PASS; before/after reports in submissions/lab9-artifacts/.
• govulncheck ./... green (exit 0); red demo with a reachable golang.org/x/text@v0.3.5 dep reports GO-2021-0113 (exit 3), then reverted.

Checklist

• Title is a clear sentence (≤ 70 chars)
• Commits are signed (git log --show-signature)
• submissions/lab9.md updated