Adam Moussa 2f2fc83a82 fix(webhook): kms:ViaService pins, https-only delivery, cross-account principal CI pin ... GPT-4.1 cross-family review of the policy surface (no BLOCK): FIX applied to the cross-account shoc-backend-dev Decrypt statement and both Lambda role KMS grants (the key is only ever used via Secrets Manager); its invariant-enforcement QUESTION answered durably with tests/test_cross_account_principal_pin.py (any new foreign IAM principal in cdk/ fails CI). Scanner mediums fixed: delivery.py and the replay script now refuse non-https URLs (urllib follows file:// and http://). SQS metadata-action and dynamodb:ListStreams NITs skipped: standard CDK grant shapes; ListStreams has no resource-level scoping. The 4 gitleaks HIGHs on docs/shoc-webhook-test-vectors.json are deliberate non-secrets (shared receiver-verification vectors) suppressed machine-level with justification.		2026-07-24 15:00:15 -04:00
..
api	feat(api): Redocly lint gate + SHOC-themed /docs (Redoc theming, topbar, collapsible samples) (#130)	2026-07-24 18:04:30 +00:00
po	chore(deps): bump boto3 (#122)	2026-07-21 16:06:26 -04:00
shared	feat(api): procurement-api read stack + OpenAPI docs (SHOC reconciliation path) (#127)	2026-07-23 19:32:20 -04:00
wo	fix(webhook): kms:ViaService pins, https-only delivery, cross-account principal CI pin	2026-07-24 15:00:15 -04:00