Skip to content

Security: add key management, SAST scanning, audit workflow, and RPC rate limiting - #348

Merged
ALLEN-AYODEJI merged 2 commits into
Trellis-Ecosystem:masterfrom
Emmyt24:fix/security-improvements
Aug 28, 2026
Merged

Security: add key management, SAST scanning, audit workflow, and RPC rate limiting#348
ALLEN-AYODEJI merged 2 commits into
Trellis-Ecosystem:masterfrom
Emmyt24:fix/security-improvements

Conversation

@Emmyt24

@Emmyt24 Emmyt24 commented Aug 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

This PR implements four major security improvements for the Trellis CLI:

1. Secure Key Management (#157)

  • Add OS keychain support for Stellar secret keys (macOS Keychain, Linux secret-tool, Windows Credential Manager)
  • New CLI commands: trellis keys add <identity> <key>, trellis keys remove <identity>, trellis keys list
  • Security warning when plaintext TRELLIS_SOURCE_KEY env var is detected
  • Key resolution order: keychain > env var > literal key

2. SAST Scanning with Semgrep (#158)

  • .semgrep/soroban-rules.yaml with Soroban-specific vulnerability patterns
  • Rules detect: unchecked auth, unchecked panic, arithmetic overflow, unsafe contract calls
  • CI integration: automatic scanning on every PR
  • Local usage: semgrep --config .semgrep/ contracts/

3. Cargo Audit Scheduled Workflow (#159)

  • Weekly RustSec Advisory Database checks (every Monday at 06:00 UTC)
  • Automated detection of CVEs in dependencies
  • CI/CD integration with workflow failure on detected vulnerabilities

4. RPC Rate Limiting (#160)

  • Configurable rate limiter (default: 10 requests/second)
  • Environment variable: STELLAR_RPC_RATE_LIMIT
  • Automatic request queuing to prevent provider abuse
  • Warning logs when rate limiting is active

Testing

  • Rate limiting: 100 rapid requests verify throttling to ~10/s
  • Key management: keychain store/retrieve/remove operations tested
  • Semgrep: CI runs on contract code and detects patterns
  • Cargo audit: workflow dispatch reports current CVEs

Dependencies

  • governor = "0.6" for rate limiting
  • keyring = "2.0" for OS keychain integration

Closes #157
Closes #158
Closes #159
Closes #160

@Emmyt24
security: add key management, SAST scanning, audit workflow, and RPC …
770bd78 
…rate limiting

## Summary

This commit implements four security improvements:

### 1. Secure Key Management (Trellis-Ecosystem#157)
- Add keystore support for secure Stellar secret key storage using OS keychains
- Implement keyring integration for macOS Keychain, Linux secret-tool, Windows Credential Manager
- Add new CLI commands: `trellis keys add`, `trellis keys remove`, `trellis keys list`
- Display security warning when plaintext TRELLIS_SOURCE_KEY env var is detected
- Provide fallback resolution: keychain > env var > literal key

### 2. SAST Scanning with Semgrep (Trellis-Ecosystem#158)
- Create `.semgrep/soroban-rules.yaml` with Soroban-specific vulnerability patterns
- Add rules for: unchecked auth, unchecked panic, arithmetic overflow, unsafe contract calls
- Integrate Semgrep into contract CI workflow (runs on every PR)
- Update CONTRIBUTING.md with local Semgrep installation and usage instructions
- Pattern detection prevents common security vulnerabilities before code review

### 3. Cargo Audit Scheduled Workflow (Trellis-Ecosystem#159)
- Add `.github/workflows/cargo-audit.yml` for weekly RustSec Advisory Database checks
- Schedule runs every Monday at 06:00 UTC (cron: 0 6 * * 1)
- Automatically detect CVEs in direct and transitive dependencies
- Workflow fails when vulnerabilities are found for CI/CD integration

### 4. RPC Rate Limiting (Trellis-Ecosystem#160)
- Add `governor` crate for rate limiting outbound RPC calls
- Default limit: 10 requests/second (configurable via STELLAR_RPC_RATE_LIMIT env var)
- Automatically queue requests that exceed the rate limit
- Log warning when active rate limiting is throttling requests
- Prevent unintentional RPC provider abuse in scripted workflows

## Technical Details

### Dependencies Added
- \`governor = \"0.6\"\` for rate limiting
- \`keyring = \"2.0\"\` for OS keychain integration

### Files Changed
- \`.github/workflows/cargo-audit.yml\`: New scheduled audit workflow
- \`.github/workflows/contract-ci.yml\`: Added Semgrep step
- \`.semgrep/soroban-rules.yaml\`: New SAST rules
- \`CONTRIBUTING.md\`: Added Semgrep section + updated section numbering
- \`cli/trellis_cli/Cargo.toml\`: Added governor and keyring dependencies
- \`cli/trellis_cli/src/main.rs\`: Added keystore module import
- \`cli/trellis_cli/src/commands/mod.rs\`: Added Keys subcommand and handlers
- \`cli/trellis_cli/src/config.rs\`: Added key resolution method
- \`cli/trellis_cli/src/keystore.rs\`: New module implementing secure key management
- \`cli/trellis_cli/src/rpc.rs\`: Added rate limiting with governor

## Testing

- Rate limiting: verify that 100 rapid requests throttle to ~10/s
- Key management: test keychain store/retrieve/remove operations
- Semgrep: verify CI scan runs on contract code
- Cargo audit: manual workflow dispatch should report current CVEs

Closes Trellis-Ecosystem#157 Trellis-Ecosystem#158 Trellis-Ecosystem#159 Trellis-Ecosystem#160
@drips-wave

drips-wave Bot commented Aug 27, 2026

Copy link
Copy Markdown

@Emmyt24 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@ALLEN-AYODEJI
ALLEN-AYODEJI merged commit 16d5acc into Trellis-Ecosystem:master Aug 28, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment