adam/meal-order-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/meal-order-manager.git synced 2026-09-30 08:53:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore(security): re-key ALB SG checkov suppression after vpc.tf

Browse source
This commit is contained in:
Adam Moussa 2026-09-21 15:21:24 -04:00
parent 6573312bb3
commit 52641fe370
No known key found for this signature in database
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.security-review/suppressions.json
View file

@ -5,7 +5,7 @@
"justification": "False positive. tests/test_submit_order.py defines a synthetic Google OAuth audience used only for mocked token verification. OAuth client IDs are public identifiers, this fixture is not a credential, and the tests make no real Google or AWS calls."
},
{
"id": "checkov-CKV_AWS_260-55",
"id": "checkov-CKV_AWS_260-39",
"justification": "The meals API ALB is the CloudFront HTTP origin for orders.seahaven.com. TLS and WAF terminate at CloudFront. Restricting the security group to the CloudFront managed prefix list would block GitHub-hosted weekly-menu HMAC publish, which must call the origin with X-Meals-Publish-Key. Application gates are HMAC on /api/publish, Cognito or Google Bearer on admin, and public submit only. Accepted as the HTTP-origin design for PLAT-215; TLS on the ALB is a follow-up."
},
{