SECURITY-213: Generate an SBOM and package provenance notes for release candidates

[kike-alt]

ID: SECURITY-213
Track: SECURITY
Difficulty: intermediate
Priority: P2
Points: 200

Description

Release readiness improves when maintainers can point to a clear package inventory and provenance record.

Acceptance Criteria

• Generate an SBOM or equivalent package inventory for maintained surfaces.
• Document how maintainers should refresh the inventory for future release candidates.
• Add or update tests, fixtures, and docs for the changed surface as needed.

Tech Stack / Files

• frontend/package-lock.json
• backend/package-lock.json
• soroban/Cargo.lock
• docs

Blocked By

None

Validation Requirements

targeted hardening checks or tests are added and maintained CI surfaces remain green

[drips-wave]

Congratulations, @memplethee-lab! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @memplethee-lab: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊