expands the project's security documentation by introducing a comprehensive threat model in `docs/SECURITY.md

[hotoke-no-Kami]

Summary

This PR expands the project's security documentation by introducing a comprehensive threat model in docs/SECURITY.md. The document outlines the application's attack surfaces, identifies key security threats, documents existing mitigations, highlights known gaps, and provides a clear process for responsibly reporting security issues.

Changes

• Expanded docs/SECURITY.md beyond the existing CSP documentation.

• Documented authenticated and unauthenticated attack surfaces.

• Added an overview of external dependencies and integrations.

• Included Stellar-specific security considerations and potential attack vectors.

• Documented the following threats and their current mitigations:

  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Insecure Direct Object Reference (IDOR)
  • Replay attacks on callbacks
  • File upload abuse
  • Wallet key theft

• Identified any remaining security gaps and areas for future hardening.

• Added a Reporting Security Issues section with the project's security@ contact.

• Added links to the security documentation from both README.md and CONTRIBUTING.md.

Documentation

• Created a comprehensive security threat model.
• Improved project documentation by making security guidance easier to discover.
• Added guidance for responsible vulnerability disclosure.

Related Issue

Closes #822
Closes #811
Closes #813
Closes #812

[drips-wave]

@hotoke-no-Kami Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits