[Advancement] Publish security threat model for StarForge CLI

[Nanle-code]

Objective

Author a formal threat model covering keys, plugins, marketplace, AI, and RPC trust boundaries.

Target area

security documentation

Context

A shared threat model guides design reviews and Wave security contributions.

Requirements

• Identify assets, adversaries, and trust boundaries
• Map mitigations to existing controls and open gaps
• Keep document living with review cadence

Acceptance criteria

• Threat model merged and linked from README/SECURITY
• Gaps cross-linked to issues where applicable
• Review cadence documented

Pull request merge requirements

Pull requests that resolve this issue must not be merged until all of the following are true:

1. All required CI checks are green on the latest commit of the PR (build, tests, lint/format, and any workflow jobs required by branch protection).
2. The branch has no merge conflicts with the target branch (master / default), and a clean merge or rebase is possible without unresolved conflicts.
3. Review feedback is addressed, and the change remains focused on this issue’s acceptance criteria.

Contributors should run the local CI-equivalent checks before opening or updating the PR (see CI_ENFORCEMENT.md and CONTRIBUTING.md).

[OpensrcLord]

@OpensrcLord has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello @maintainer, Interested in working on this. I'll ensure the implementation is clean, tested, and aligned with project standards.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @OpensrcLord to this issue.

[Ebuka321]

@Ebuka321 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Good day. Please can i work on these issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ebuka321 to this issue.

[kryputh]

Please can I work on this issue 🙏

[tunmisedasa]

@tunmisedasa has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hey Maintainer,

I can help resolve this issue. Can you assign me?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @tunmisedasa to this issue.

[drips-wave]

Congratulations, @OpensrcLord! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @OpensrcLord: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[OpensrcLord]

@OpensrcLord Implemented and opened OpensrcLord#1. The PR adds the formal threat model, trust-boundary controls/gaps, review cadence, and README link. Please review CI and security scope.

[OpensrcLord]

@OpensrcLord Correction: the implementation is now submitted to the upstream repository at #868, using the fork branch only as the PR head. This is the canonical PR for review and issue closure.