Fill in every section. Keep the headings. Total 100 pts (see rubric at the end). This is team work (2–3). Do not share your report with other teams.
Cover
| Field | Value |
|---|---|
| Team name | |
| Members (name + ID) | |
| Target application | |
| Repository URL | |
| Date |
AI-tool usage disclosure
Academic integrity: state how you used any AI tools (ChatGPT, Copilot, etc.) — e.g. searching, coding, translating, drafting. "None" is a valid answer.
| Tool | How it was used |
|---|---|
1. Executive Summary
(½ page) What the app is, how many findings by severity, and the overall risk before vs. after your fixes.
2. System Scope & Function
- What the application does; in-scope components and endpoints.
- Data-Flow Diagram (DFD): processes, data stores, external entities, trust boundaries (insert image).
3. Threat Model — STRIDE (20 pts)
| Element / data flow | S | T | R | I | D | E | Top threat & mitigation |
|---|---|---|---|---|---|---|---|
Then rank the top 5 risks by likelihood × impact.
4. Vulnerability Findings (25 pts)
One block per finding (copy as needed):
Finding F-01 — <title>
| Field | Value |
|---|---|
| CWE | CWE-___ |
| OWASP 2025 | A__ / API__ / LLM__ |
| Severity | Critical / High / Medium / Low |
| Location | file:line or endpoint |
| Reproduction | step-by-step (payload/command) |
| Impact | what an attacker gains |
| Evidence | screenshot / request-response |
5. Remediation (25 pts)
Per finding: the fix, before/after code, and the commit that implements it.
Fix for F-01
- vulnerable line
+ fixed line- Why this fixes it: …
- Commit:
<hash> - Proof the exploit now fails: (screenshot)
6. Supply-Chain Hardening (15 pts)
- SBOM (CycloneDX) generated — attach
sbom.json, note component count. - Artifact signed & verified with Cosign — paste the
cosign verifyoutput. - One-paragraph SLSA self-assessment (which level, why).
7. Security CI Pipeline (10 pts)
- Link to the GitHub Actions workflow (SAST + SCA + secret scanning).
- Screenshot of a build failing on a HIGH/CRITICAL finding.
- How the gate is configured (what fails the build).
8. Conclusion & Reflection (5 pts — clarity)
- Residual risks and what you'd harden next.
- Lessons learned.
Appendix
- Tools used, references (OWASP/CWE links), and the team's task split.
Grading rubric (100)
| Criterion | Pts |
|---|---|
| Threat model quality & completeness (§3) | 20 |
| Vulnerability findings — correctness, CWE/OWASP mapping, depth (§4) | 25 |
| Remediation quality — correct, minimal, well-explained (§5) | 25 |
| Supply-chain hardening — SBOM + signing + provenance (§6) | 15 |
| CI pipeline — works, fails build appropriately (§7) | 10 |
| Presentation & report clarity (§1, §8) | 5 |
All work stays within the ethics policy.