Add CI/CD Pipeline Automated Security Scanning

[famvilianity-eng]

Add CI/CD Pipeline Automated Security Scanning

Priority: High
Estimated Time: 2 hours

Description

The CI/CD pipeline does not scan code for security vulnerabilities. Unsafe dependencies or code patterns could reach production.

Tasks

• Integrate cargo-audit to check for known vulnerable dependencies
• Integrate cargo-deny for license compliance checks
• Integrate SAST tool like semgrep for code pattern violations
• Fail CI if vulnerabilities found (with override capability for acknowledged risks)
• Generate security report on every merge to main

---

Auto-created from UNSOLVED_ISSUES_40.md

[canicefavour]

@canicefavour has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I can implement a security-focused CI/CD pipeline by integrating cargo-audit, cargo-deny, and semgrep, configuring the workflow to fail on unapproved vulnerabilities while supporting explicit overrides for acknowledged risks, and generating security reports on merges to main to provide continuous visibility into dependency, license, and code-level security.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @canicefavour to this issue.

[paulinaapeh8]

@paulinaapeh8 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Trust me I can work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @paulinaapeh8 to this issue.

[Phantomcall]

@Phantomcall has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

i would love to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Phantomcall to this issue.

[drips-wave]

Congratulations, @paulinaapeh8! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @paulinaapeh8: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊