Add per-product audits pages - #2737
Conversation
|
Preview is available here: |
1 similar comment
|
Preview is available here: |
|
Preview is available here: |
|
Preview is available here: |
|
Preview is available here: |
JFWooten4
left a comment
JFWooten4
left a comment
There was a problem hiding this comment.
Extremely happy to see this. Refs: stellar/stellar-protocol#1979 (comment)
|
|
||
| # Soroban Rust SDK |
There was a problem hiding this comment.
The page automatically renders a header title which matches the frontmatter title. This came up in #2673 (review), and we are trying to get rid of the duplicative declaration (which can also drift from updated page titles). I'd suggest removing it for a cleaner editing experience decluttered from redundancy.
| # Soroban Rust SDK |
There was a problem hiding this comment.
I'm looking at the rendered pages and I don't see duplicate headings. As far as I can tell the heading I'm including here is rendering like all the other pages do on the production deployment. If there are plans to change the headings, it should probably happen holistically? Defer to @briwylde08 @ElliotFriend.
For example:
|
|
||
| # Soroban Host Environment |
There was a problem hiding this comment.
Is the intent here and in docs/networks/audits/soroban-sdk.mdx to ever expand to network projects like the SDF-sponsored OZ contracts? I get wary anytime I see files with the same base prefix but no shared directory, creating disorganized scope.
| # Soroban Host Environment |
There was a problem hiding this comment.
Maintainers of software components should probably host their own audit evidence, so I don't expect the software components listed here will expand outside of components that SDF is maintaining. But regardless it's probably a bit early to make any assumptions, and nothing we do here prevents us from restructuring in the future to support other projects being listed.
Discussing the suggested change at #2737 (comment).
|
Preview is available here: |
1 similar comment
|
Preview is available here: |
Added auditor column
154278d to
be6e422
Compare
|
Preview is available here: |
1 similar comment
|
Preview is available here: |
|
Preview is available here: |
|
Preview is available here: |
|
Preview is available here: |
|
Something went wrong with PR preview build please check |
There was a problem hiding this comment.
Pull request overview
Adds a new Networks → Audits section to the Stellar docs, with per-product pages intended to list audit reports by audited version.
Changes:
- Adds a new
docs/networks/audits/section (index + product pages) with version→auditor→report tables. - Adds navigation and route entries for the new Audits pages.
- Introduces
.audits-tablestyling in global SCSS for grouped/indented audit rows.
Recommendation: NEEDS-CHANGES — The audits content contains future-dated report filenames/links (2027-03-07) and the PR description doesn’t match the implemented scope/content (placeholders vs real entries; “one page per product” vs combined/extra pages).
Reviewed changes
Copilot reviewed 7 out of 16 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/css/custom.scss | Reformatting + adds .audits-table styling for audits tables and sub-rows. |
| routes.txt | Registers new routes for the audits index and product pages. |
| docs/networks/audits/README.mdx | Adds the Audits landing page under Networks. |
| docs/networks/audits/stellar-core.mdx | Adds Stellar Core audits table (currently also covers Soroban host environment in-page). |
| docs/networks/audits/soroban-sdk.mdx | Adds Soroban Rust SDK audits table with sub-audit rows and links. |
| docs/networks/audits/soroban-poseidon.mdx | Adds Soroban Poseidon SDK audits table and report link. |
| config/theme/navbar.ts | Adds “Audits” to the Networks navbar dropdown. |
Suppressed comments (1)
docs/networks/audits/stellar-core.mdx:16
- The PR description says the audits tables are “seeded with a placeholder row only”, but this page includes multiple specific audit entries and links to concrete reports. Please reconcile the PR description with the actual content (either switch to placeholder rows or update the description to reflect real seeded data).
| Version | Auditor | Audit |
| --- | --- | --- |
| `v25.0.0` | Runtime Verification | [Stellar Core & Soroban Environment Audit](/assets/audits/2026-02-06%20-%20Runtime%20Verification%20-%20stellar-core%20v25.0.0%20-%20soroban%20environment.pdf) |
| `v24.0.0` | Oak Security | [Stellar Core Protocol 24 Changes](/assets/audits/2025-11-13%20-%20Oak%20-%20stellar-core%20v24.0.0%20-%20protocol%2024%20changes.pdf) |
| `v23.0.0` | Oak Security | [Stellar Core Protocol 23 Changes](/assets/audits/2025-10-17%20-%20Oak%20-%20stellar-core%20v23.0.0%20-%20protocol%2023%20changes.pdf) |
| `v20.0.0` | Veridise | [Stellar Soroban Core](/assets/audits/2024-01-03%20-%20Veridise%20-%20stellar-core%20v20.0.0%20-%20soroban.pdf) |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Preview is available here: |
|
Preview is available here: |
* Add Stellar RPC audits page Adds a per-product audits page for stellar-rpc following the structure from #2737, carrying the OtterSec security assessment of stellar-rpc (assessment Nov 27 - Dec 11 2024, report dated Dec 20 2024; 1 medium, 2 low findings, all resolved via stellar-rpc#343, released in v22.1.2). The report PDF is added under static/assets/audits/ using the existing file naming pattern, and the route is registered in routes.txt. * Fix Table formatting Updated audit version and removed outdated assessment details. * remove unnecessary h1 title --------- Co-authored-by: Elliot <elliot@stellar.org>
What
Add an Audits section under Networks, next to Software Versions, with a page per product — Stellar Core, Soroban Host Environment, Soroban Rust SDK — each holding a version-to-audit-report table.
Why
Published audit reports aren't listed anywhere in the docs, so there's no way to tell which version of a product was audited or by whom. Tables are seeded with a placeholder row only, to be filled in with the real audit entries.