Add Stellar RPC audits page - #2787
Conversation
Adds a per-product audits page for stellar-rpc following the structure from #2737, carrying the OtterSec security assessment of stellar-rpc (assessment Nov 27 - Dec 11 2024, report dated Dec 20 2024; 1 medium, 2 low findings, all resolved via stellar-rpc#343, released in v22.1.2). The report PDF is added under static/assets/audits/ using the existing file naming pattern, and the route is registered in routes.txt.
Updated audit version and removed outdated assessment details.
There was a problem hiding this comment.
Pull request overview
Adds a Stellar RPC audits page and registers it in the documentation.
Changes:
- Adds the OtterSec audit report and audit details.
- Registers the new route.
- One unverified version attribution requires correction.
Recommendation: NEEDS-CHANGES — remove or qualify the unconfirmed v22.1 attribution.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
routes.txt |
Registers the Stellar RPC audits route. |
docs/networks/audits/stellar-rpc.mdx |
Adds the audit entry and remediation details. |
static/assets/audits/2024-12-20 - OtterSec - stellar-rpc commit a60044e.pdf |
Adds the audit report. |
Suppressed comments (1)
docs/networks/audits/stellar-rpc.mdx:15
- The statement that the audited snapshot came from the v22.1 release series is not currently verifiable: the report names
a60044e, but that commit does not exist in the publicstellar/stellar-rpcrepository, and the PR description says OtterSec confirmation is still pending. Remove the release-series attribution (or explicitly mark it unconfirmed) until the audited repository and revision are confirmed.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Preview is available here: |
1 similar comment
|
Preview is available here: |
ElliotFriend
left a comment
ElliotFriend
left a comment
There was a problem hiding this comment.
this looks great! thanks for putting it up here. i'll take care of the h1 thing, but just wanted to share the context
|
Preview is available here: |
Adds a per-product audits page for
stellar-rpc, following the structure from #2737, carrying the OtterSec security assessment of stellar-rpc (assessment Nov 27 - Dec 11 2024, report dated Dec 20 2024; 1 medium, 2 low findings, all resolved via stellar-rpc#343, released in v22.1.2).The report PDF is added under
static/assets/audits/using the existing file naming pattern, and the route is registered inroutes.txt.Note: Ottersec listed a specific commit hash,
a60044e, instead of a version tag for audit. This needs updating in the official report. The commit hash is not in the working tree ofstellar-rpc, which means that the repo was snapshotted and given to Ottersec off the main, public repo. Through sleuthing, I was able to confirm that this commit aligns withv22.1.0, but we need to get official confirmation from Ottersec and identify the actual repo audited.