fix: document remaining semgrep exceptions

result/server.js

@@ -4,6 +4,8 @@ var express = require('express'),
     { Pool } = require('pg'),
     client = require('prom-client'),
     cookieParser = require('cookie-parser'),
+    // nosemgrep: javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage
+    // Result service exposes read-only GET endpoints; the voting POST path is protected in vote/app.py.
     app = express(),
     server = require('http').Server(app),
     io = require('socket.io')(server);

terraform/environments/aws/oidc.tf

@@ -35,7 +35,7 @@ resource "aws_iam_role_policy" "github_actions_ecr" {
     Statement = [
       {
         Effect = "Allow"
-        Action = [
+        Action = [ # nosemgrep: terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure - AWS requires ecr:GetAuthorizationToken on "*" for ECR login; push/pull actions are repository scoped below.
           "ecr:GetAuthorizationToken"
         ]
         Resource = "*"

terraform/environments/azure/secrets.tf

@@ -6,7 +6,7 @@ resource "random_password" "azure_db_password" {
   override_special = "!#$%&*()-_=+[]{}<>:?"
 }
 
-resource "azurerm_key_vault" "app" {
+resource "azurerm_key_vault" "app" { # nosemgrep: terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl - Network ACL is declared below; default allow is retained for External Secrets demo access until private endpoint/VPN is active.
   name                          = replace("${var.name_prefix}-kv", "-", "")
   location                      = var.location
   resource_group_name           = module.azure_networking.resource_group_name

terraform/modules/eks/main.tf

@@ -201,18 +201,16 @@ resource "aws_cloudwatch_log_group" "eks" {
 }
 
 # ─── EKS Cluster ──────────────────────────────────────────────────
-resource "aws_eks_cluster" "main" {
+resource "aws_eks_cluster" "main" { # nosemgrep: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled - CIDR-scoped public API is retained for bootstrap/demo access until VPN/Bastion access is active.
   name     = var.cluster_name
   role_arn = aws_iam_role.eks_cluster.arn
   version  = var.kubernetes_version
 
   vpc_config {
     subnet_ids              = var.subnet_ids
     endpoint_private_access = true
-    # nosemgrep: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled
-    # The lab keeps a CIDR-scoped public API endpoint for bootstrap/demo access until the VPN/Bastion path is active.
-    endpoint_public_access = var.endpoint_public_access
-    public_access_cidrs    = var.endpoint_public_access ? var.public_access_cidrs : []
+    endpoint_public_access  = var.endpoint_public_access
+    public_access_cidrs     = var.endpoint_public_access ? var.public_access_cidrs : []
   }
 
   # Encryption at-rest cho K8s secrets (etcd)

vote/templates/index.html

@@ -11,7 +11,7 @@
     <div id="content-container">
       <div id="content-container-center">
         <h3>{{option_a}} vs {{option_b}}!</h3>
-        <form id="choice" name='form' method="POST" action="/">
+        <form id="choice" name='form' method="POST" action="/"> {# nosemgrep: python.django.security.django-no-csrf-token.django-no-csrf-token - Flask validates this HMAC token before accepting a vote. #}
           <input type="hidden" name="csrf_token" value="{{csrf_token}}">
           <button id="a" type="submit" name="vote" class="a" value="a" {% if vote == "a" %}disabled{% endif %}>{{option_a}}{% if vote == "a" %} ✓{% endif %}</button>
           <button id="b" type="submit" name="vote" class="b" value="b" {% if vote == "b" %}disabled{% endif %}>{{option_b}}{% if vote == "b" %} ✓{% endif %}</button>