Filed from the second-wave repository audit (issue 78/100). See the audit summary for full category context.
- Location:
.github/workflows/security.yml:16-45 (dependency-check job); .github/dependabot.yml:20-31
- Problem: The
dependency-check job only runs npm audit against the three npm scopes; there is no cargo audit/cargo deny step for contracts/Cargo.lock (soroban-sdk and transitive crates), despite dependabot.yml already acknowledging a dedicated Cargo ecosystem exists. Separately, all three npm audit invocations use --audit-level=critical, silently ignoring high-severity findings in production dependencies.
- Evidence: No Cargo-ecosystem scan in
security.yml; npm audit calls hardcode critical as the failure threshold.
- Suggested implementation: Add a
cargo audit (or cargo deny check advisories) step for the contracts workspace, and lower the npm audit failure threshold to high.
- Acceptance criteria: CI fails on a known
high-or-above npm vulnerability and on any Cargo advisory match for the contracts workspace.
- Difficulty: S
- Expected impact: Closes a real supply-chain scanning gap for both the on-chain contract and the off-chain services.
.github/workflows/security.yml:16-45(dependency-checkjob);.github/dependabot.yml:20-31dependency-checkjob only runsnpm auditagainst the three npm scopes; there is nocargo audit/cargo denystep forcontracts/Cargo.lock(soroban-sdk and transitive crates), despitedependabot.ymlalready acknowledging a dedicated Cargo ecosystem exists. Separately, all threenpm auditinvocations use--audit-level=critical, silently ignoringhigh-severity findings in production dependencies.security.yml;npm auditcalls hardcodecriticalas the failure threshold.cargo audit(orcargo deny check advisories) step for the contracts workspace, and lower the npm audit failure threshold tohigh.high-or-above npm vulnerability and on any Cargo advisory match for the contracts workspace.