feat: implement security enhancements — #453, #461, #462, #465

[Smartdevs17]

Summary

This PR implements four security-related issues in a single changeset.

Closes

• Closes [contracts] Enforce Core Float Invariant On-Chain #453
• Closes [security] Data Privacy & Right-to-be-Forgotten: GDPR/CCPA Compliance, Selective Deletion, Anonymization #461
• Closes [backend] Transaction Simulation & Pre-Execution Validation: Dry-Run, Gas Estimation, Failure Prediction #462
• Closes [security] Penetration Testing Program: Annual External Pentest, Continuous Bug Bounty, Red Team Exercises #465

---

Changes

#453: Enforce Core Float Invariant On-Chain

contracts/agent_vault/src/lib.rs — Added two new view functions:

• check_invariant(agent) — Returns (holds, float, max_allowed) for a single agent. Emits an InvariantChecked event for indexer consumption.
• check_invariants(agents) — Batch invariant check across multiple agents.

contracts/agent_vault/src/events.rs — Added invariant_checked event publisher.

contracts/agent_vault/src/test.rs — Added 4 unit tests for invariant checks (solvent vault, empty vault, boundary, batch).

CONTRACTS.md — New document describing the core solvency invariant, enforcement points, and governance.

#461: Data Privacy & Right-to-be-Forgotten (GDPR/CCPA)

backend/src/services/privacyService.ts — Privacy service with:

• DSAR request creation (access, deletion, anonymization)
• User data export (all tables)
• Selective PII deletion (preserves anonymized financial records)
• Anonymization pipeline (SHA-256 hash-based PII replacement)

backend/src/controllers/privacyController.ts — DSAR endpoint handlers.

backend/src/routes/privacyRoutes.ts — RESTful privacy routes:

• POST /api/v1/privacy/dsar/access — Request data copy (GDPR Art. 15)
• POST /api/v1/privacy/dsar/delete — Request deletion (GDPR Art. 17)
• POST /api/v1/privacy/anonymize — Anonymize for analytics
• GET /api/v1/privacy/export/:publicKey — Export all data
• GET /api/v1/privacy/dsar/:dsarId — Check DSAR status
• GET /api/v1/privacy/dsar/pending — Admin: list pending DSARs

backend/src/schemas/privacySchemas.ts — Zod validation schemas.

backend/migrations/1803000000000_create-dsar-requests.js — Database migration for DSAR tracking table.

docs/DPA_TEMPLATE.md — Data Processing Agreement template for agent onboarding.

#462: Transaction Simulation & Pre-Execution Validation

backend/src/services/transactionSimulationService.ts — Soroban simulation service with:

• Dry-run execution via Stellar RPC simulateTransaction
• Gas estimation from simulation cost
• Return value decoding
• Warning detection (high CPU/memory, event count)
• 30-second Redis caching

backend/src/controllers/simulationController.ts — Added simulateTransaction handler.

backend/src/routes/simulationRoutes.ts — New endpoint:

• POST /api/v1/simulation/simulate/transaction — Pre-execution validation with dry-run

backend/src/schemas/simulationSchemas.ts — Zod schema for simulation requests.

#465: Penetration Testing Program & Security

SECURITY.md — Enhanced with:

• Safe harbor provisions for security researchers
• Annual external pentest program details
• Continuous bug bounty program (rewards, scope, eligibility)
• Quarterly red team exercise schedule
• Automated security scanning (SAST/DAST/dependency)
• Security headers documentation
• Incident response procedures

.github/workflows/dast.yml — New CI workflow:

• Weekly OWASP ZAP baseline scan
• OWASP ZAP API scan with OpenAPI spec

.zap/rules.tsv — ZAP baseline scan rule configuration.

.zap/api-rules.tsv — ZAP API scan rule configuration.

docs/BUG_BOUNTY_PROGRAM.md — Comprehensive bug bounty documentation with reward tiers, scope, and safe harbor.

docs/RED_TEAM_SCHEDULE.md — Quarterly red team exercise schedule with scope, activities, and metrics.

---

CI Verification

All existing CI checks should pass:

• Supply chain audit (no new dependencies)
• Backend lint, build, typecheck
• Contract fmt, clippy, test
• Security gates (Semgrep, Gitleaks, Trivy, npm/cargo audit)
• CodeQL analysis

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5fe82436-db61-421d-98e9-ef9db09c0fc1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[drips-wave]

@Smartdevs17 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits