docs: Write security model documentation covering threat actors and mitigations

[FaveTeamz]

Summary

The project handles cryptographic key authorization and on-chain state transitions with financial implications. There is no documented security model describing threat actors, attack surfaces, mitigations, and residual risks.

Problem

Without a formal security model, contributors and auditors cannot quickly assess whether a proposed change introduces new attack vectors. Security reviewers must reconstruct the threat model from source code.

Acceptance Criteria

• Create docs/security-model.md covering:
  • Threat actors: malicious contributors, rogue maintainers, compromised admin keys
  • Attack surfaces: API endpoints, contract function calls, Horizon node trust
  • Mitigations: rate limiting, signature verification, cap enforcement, WAF
  • Residual risks: Stellar network downtime, Horizon RPC compromise
• Include a data flow diagram showing where auth checks occur
• Reference specific error codes from docs/error-reference.md where relevant
• Link from the README security section

[Netty-kun]

@Netty-kun has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer, I'd love to work on this.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Netty-kun to this issue.

[chikawobishie-sketch]

@chikawobishie-sketch has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, I’ve reviewed the issue and understand the requirements. I’m ready to start immediately. Kindly assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @chikawobishie-sketch to this issue.

[Xoft31]

@Xoft31 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

After reviewing the requirements, I believe I can contribute effectively to this issue. I’d be happy to take it forward and ensure the implementation addresses the acceptance criteria without introducing unnecessary complexity.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Xoft31 to this issue.

[Silver36-ship-it]

@Silver36-ship-it has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would love to work on this professionally, please assign it to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Silver36-ship-it to this issue.

[FreshTVMax]

@FreshTVMax has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Pls let me work on this issue and will get back with a positive feedback

ℹ️ Repo Maintainers: To accept this application, review their application or assign @FreshTVMax to this issue.

[soter-fashion]

@soter-fashion has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

hello maintainer i will like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @soter-fashion to this issue.

[drips-wave]

Congratulations, @soter-fashion! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @soter-fashion: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊