bug(scripts): verify.sh still sources .env unsafely via shell source

[K1NGD4VID]

Summary

scripts/verify.sh loads its configuration with source .env (line 18), which executes the file as arbitrary shell code. scripts/deploy.sh had this exact vulnerability and was fixed (see closed issue #455) by replacing source with a safe line-by-line load_env parser that only accepts KEY=VALUE pairs. That fix was never applied to verify.sh.

Current Behavior

scripts/verify.sh:18 runs:

source .env

Any shell metacharacters, command substitutions, or malicious lines in .env (which may be populated from copy-pasted testnet output or third-party contributions) are executed with the privileges of whoever runs verify.sh.

Expected Behavior

verify.sh should load .env using the same safe load_env line-by-line parser already implemented in deploy.sh, ideally by extracting it into a shared helper both scripts source, so verify.sh gets the same CVE-class protection.

Acceptance Criteria

• verify.sh no longer calls source .env directly
• .env is parsed with the same safe KEY=VALUE-only logic used in deploy.sh
• Shell metacharacters in .env values cannot cause code execution when running verify.sh
• Existing verify.sh behavior (env var checks, contract invocations) is unchanged for well-formed .env files

Tech Stack

Bash — scripts/verify.sh, cross-reference scripts/deploy.sh's load_env function

[Abba073]

@Abba073 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would like to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Abba073 to this issue.

[code-0-stella]

@code-0-stella has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello, I have reviewed the issue and understand what needs to be done.

I would appreciate being assigned to it.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @code-0-stella to this issue.

[GoabDev]

@GoabDev has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I’d like to work on this issue.

I’ll replace the unsafe source .env usage in scripts/verify.sh with the safe KEY=VALUE parsing approach used by deploy.sh.

I’ll preserve existing behavior and add tests to ensure malicious .env content isn’t executed while valid variables continue to load correctly.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @GoabDev to this issue.

[tzar-deek]

@tzar-deek has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintainer can I get on this issue for you real quick, I see that this issue aligns with one of the issues I fixed earlier, let me get on this for you real quick.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @tzar-deek to this issue.

[drips-wave]

Congratulations, @tzar-deek! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @tzar-deek: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊