Refresh secure delivery demo status copy

[asarkar157]

Fresh application PR for the advisory-Trivy security-controls rerun. The application code change is intentionally small and awaits human approval after controls and scans complete.

[asarkar157]

@/tmp/pr6-security-comment.md

[asarkar157]

Security controls were already present on main at d91cfb2fcb087ab8262a12895109ce77bffca4e6; no controls PR was created or merged.

Installed destination: .github/workflows/security-gate.yml (40deab4a078437f0a3e46d47d154248c6c715b44).

The security-gate required status check is enforced by the active talkdesk-demo-security-gate ruleset (ID 20855572). asarkar157 has pull-request-only bypass. The branch will now be updated.

[asarkar157]

Security review — gate allowed

Blocking: None. Gitleaks, Semgrep, tests, policies, and security-gate succeeded; required artifacts were present. No secrets, Semgrep findings, or dependency CVEs were reported.

Advisory Trivy IaC findings (infra/aws/main.tf; Trivy succeeded):

• AWS-0104 Critical — aws_security_group.ec2: restrict egress CIDR ranges.
• AWS-0053 High — aws_lb.demo: use an internal load balancer when public exposure is unnecessary.
• AWS-0132 High — aws_s3_bucket_server_side_encryption_configuration.evidence: use SSE-KMS with a customer-managed key.
• AWS-0164 High — aws_subnet.public[0], aws_subnet.public[1]: disable public IP assignment where not required.

Next: remediate the advisory infrastructure findings as appropriate. Security gate run · Gitleaks artifact · Semgrep artifact · Trivy artifact · Gate artifact

[asarkar157]

@/tmp/pr6-security-comment.md