feat(lab2): report + auth model + secure model

[sofifaro]

Goal

Lab 2: Perform threat modeling on OWASP Juice Shop using Threagile, produce baseline and secure variant risk reports, and optionally model the authentication flow.

Changes

• labs/lab2/threagile-model.yaml — baseline threat model
• labs/lab2/threagile-model-secure.yaml — hardened variant with HTTPS, authentication, and encryption
• labs/lab2/threagile-model-auth.yaml — bonus authentication‑focused model
• submissions/lab2.md — final report with risk tables, STRIDE mapping, and reflections

Testing

Run baseline model

docker run --rm \
  -v "$(pwd)/labs/lab2":/app/work \
  threagile/threagile:0.9.1 \
  -model /app/work/threagile-model.yaml \
  -output /app/work/output \
  -generate-risks-excel=false \
  -generate-tags-excel=false

Run secure variant

docker run --rm \
  -v "$(pwd)/labs/lab2":/app/work \
  threagile/threagile:0.9.1 \
  -model /app/work/threagile-model-secure.yaml \
  -output /app/work/output-secure \
  -generate-risks-excel=false \
  -generate-tags-excel=false

Run auth model (bonus)

docker run --rm \
  -v "$(pwd)/labs/lab2":/app/work \
  threagile/threagile:0.9.1 \
  -model /app/work/threagile-model-auth.yaml \
  -output /app/work/output-auth \
  -generate-risks-excel=false \
  -generate-tags-excel=false

Observed output:

Baseline: 23 risks (Elevated:4, Medium:14, Low:5)
Secure:   20 risks (Elevated:2, Medium:13, Low:5)
Auth:     27 risks (High:1, Elevated:5, Medium:18, Low:3)
All runs produced report.pdf, data-flow diagrams, risks.json, and stats.json.

Artifacts & Screenshots

• submissions/lab2.md
• labs/lab2/threagile-model.yaml
• labs/lab2/threagile-model-secure.yaml
• labs/lab2/threagile-model-auth.yaml (bonus)

Checklist

• Task 1 done — Baseline threat model run, top‑5 risks listed, STRIDE mapping, trust boundary observation
• Task 2 done — Secure variant created, risk diff table, honesty check
• Bonus done — Auth‑focused model with 3 auth‑specific risks and reflection