docs: add Stellar-specific security considerations to SECURITY.md (#812) - #825

#!/bin/bash
set -euo pipefail

echo "== FILES =="
git ls-files | rg '(^|/)SECURITY\.md$|readme|README' || true

echo "== SECURITY.md excerpt =="
if [ -f SECURITY.md ]; then
  wc -l SECURITY.md
  sed -n '55,85p' SECURITY.md | cat -n
fi

echo "== Network passphrase mentions =="
rg -n "Futurenet|Future Network|Testnet|Mainnet|NETWORK_PASSPHRASE|separator" SECURITY.md 2>/dev/null || true

echo "== Stellar passphrase documentation check =="
python3 - <<'PY'
# Read-only check of repository context only; no external request should block final if needed.
import subprocess, sys
print("python available:", sys.version.split()[0])
PY

#!/bin/bash
set -eu

rg -n --hidden -g '!.git' \
  '(process\.env|import\.meta\.env|os\.environ|getenv|NETWORK_PASSPHRASE|SECRET|PRIVATE|SEED|KEY|TOKEN)'

#!/bin/bash
set -eu

echo "## SECURITY.md around target line"
if [ -f SECURITY.md ]; then
  wc -l SECURITY.md
  sed -n '1,130p' SECURITY.md | nl -ba | sed -n '60,95p'
else
  echo "SECURITY.md not found"
fi

echo
echo "## Relevant env/API/security references in repo"
rg -n \
  -g '!/.git' \
  '(process\.env|import\.meta\.env|os\.environ|getenv\(|NETWORK_PASSPHRASE|PASSPHRASE|SECRET|PRIVATE|SEED|KEY|TOKEN|API_KEY|API_SECRET|ENVS?|dotenv|dotenv-expand)' \
  . || true

echo
echo "## README/config/env-like filenames"
fd -t f '^(README|SECURITY|env|.*env.*|.*config.*|.*secret.*|.*token.*|.*key.*)' . | sed -n '1,200p'

#!/bin/bash
set -eu

echo "## SECURITY.md lines 70-88"
sed -n '70,88p' SECURITY.md

echo
echo "## .env/.env.* / config-like secrets references, excluding generated frontend reports"
rg -n \
  -g '!frontend/playwright-report' -g '!*.ts.snap' -g '!*.css' -g '!*.js' -g '!*.jsx' -g '!*.tsx' \
  '\.env|VITE_.*SECRET|VITE_.*PRIVATE|VITE_.*TOKEN|VITE_.*KEY|VITE_.*SIGNING|JWT_SECRET|SERVER_PRIVATE_KEY|SECRET_KEY|WEBHOOK_SIGNING_SECRET|NETWORK_PASSPHRASE|CONTRACT_ID' \
  . || true

echo
echo "## Read-only semantic probe: .gitignore controls untracked files only"
python3 - <<'PY'
from pathlib import Path
import subprocess

tmp = subprocess.check_output(["mktemp", "-d"], text=True).strip()
repo = Path(tmp) / "repo"
repo.mkdir()
(repo / ".git").mkdir()
(repo / ".gitignore").write_text(".env\n")
(repo / "tracked.txt").write_text("tracked")
(repo / ".env").write_text("SECRET=in_file")
(repo / "directory/.env").mkdir(parents=True)
(repo / "directory/.env").write_text("SECRET=in_directory")

patterns = [
    ("file .env untracked", str(repo / ".env")),
    ("directory .env untracked", str(repo / "directory/.env")),
    ("untracked sibling", str(repo / "secret.txt")),
]
for description, path in patterns:
    out = subprocess.check_output(
        ["git", "-C", str(repo), "check-ignore", "-v", path],
        stderr=subprocess.DEVNULL, text=True, check=False
    )
    print(f"{description}: {'ignored by gitignore' if out.strip() else 'not ignored by gitignore'}")

tracked = repo / "tracked.txt"
tracked.write_text("")
out = subprocess.check_output(
    ["git", "-C", str(repo), "check-ignore", "-v", str(tracked)],
    stderr=subprocess.DEVNULL, text=True, check=False
)
print(f"tracked.txt: {'ignored by gitignore' if out.strip() else 'not ignored by gitignore'}")
PY

#!/bin/bash
set -euo pipefail

echo "SECURITY.md relevant section:"
sed -n '1,140p' SECURITY.md | nl -ba | sed -n '80,110p'

echo
echo "Search for Stellar ledger/block terminology:"
rg -n "block|ledger|flash" SECURITY.md || true

echo
echo "Repository files (top-level, relevant docs):"
git ls-files | sed -n '1,120p'

#!/bin/bash
set -euo pipefail

echo "SECURITY.md relevant section:"
sed -n '80,110p' SECURITY.md | awk '{printf "%4d  %s\n", NR+79, $0}'

echo
echo "Security doc references to block/ledger/flash:"
grep -n -i 'block\|ledger\|flash' SECURITY.md || true

echo
echo "Repository files (top-level, relevant docs):"
git ls-files | sed -n '1,160p'

#!/bin/bash
set -euo pipefail

echo "SECURITY.md top relevant section header/lines 86-95:"
sed -n '86,96p' SECURITY.md | awk '{printf "%4d  %s\n", NR+85, $0}'

#!/bin/bash
set -euo pipefail
sed -n '95,100p' SECURITY.md | awk '{printf "%4d  %s\n", NR+94, $0}'