ci: No dependency vulnerability audit in any workflow — cargo audit and npm audit missing

[dimka90]

Description

The CI pipeline runs linting, tests, builds, bundle-size budget checks, WASM size monitoring, and benchmarks, but includes zero dependency auditing. There is no cargo audit or cargo deny step for Rust dependencies (which include cryptographic and serialization libraries), and no npm audit for the web frontend.

A security-audit.yml workflow exists in the repo but is not triggered on push or pull_request — it requires manual dispatch. A transitive dependency vulnerability in either the smart contract or the web app would ship to production undetected.

Proposed Fix

1. Add cargo audit step to the contract CI job
2. Add npm audit --audit-level=high step to the web CI job
3. Or trigger security-audit.yml on push/PR instead of manual-only

Acceptance Criteria

• Contract dependencies audited in CI
• Web dependencies audited in CI
• Known vulnerabilities block merge
• security-audit.yml runs on push/PR

Affected Files

• .github/workflows/ci.yml
• .github/workflows/security-audit.yml

[AdEmOnD07]

@AdEmOnD07 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I will like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @AdEmOnD07 to this issue.

[owohdora-stack]

@owohdora-stack has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Good day maintainer am active to resolve this issue, have gone through it and will carry out the task perfectly and diligently
Kindly assign this to me thanks

ℹ️ Repo Maintainers: To accept this application, review their application or assign @owohdora-stack to this issue.

[Saber1Y]

@Saber1Y has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’d like to work on this issue because it aligns with my experience in Web3 development and smart contracts. I’m comfortable working with Solidity and blockchain-based applications, and I’d be interested in contributing a clean and well-tested implementation for this feature.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Saber1Y to this issue.

[abdulwahabmuhsinah86-afk]

@abdulwahabmuhsinah86-afk has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi I will like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @abdulwahabmuhsinah86-afk to this issue.

[mimijuwonlo-commits]

@mimijuwonlo-commits has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

can i handle this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @mimijuwonlo-commits to this issue.

[drips-wave]

Congratulations, @mimijuwonlo-commits! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @mimijuwonlo-commits: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊