Add npm audit and Snyk vulnerability scanning to CI with threshold enforcement

[nanaf6203-bit]

Area: Security
Priority: P1 — High

Description

Vulnerable dependencies introduce risk. There is no automated scan in CI. Add vulnerability scanning that blocks merging vulnerable code and tracks drift over time.

Acceptance Criteria

• Add CI job security-audit running npm audit --audit-level=high
• Job fails if vulnerabilities exceed threshold (high or critical)
• Add weekly scheduled workflow (cron) for drift detection
• Configurable Snyk integration via env var SNYK_TOKEN (no-op when unset)
• Run snyk test --severity-threshold=high when token available
• Suppress known false positives via .snyk policy file
• Document vulnerability policy in docs/SECURITY.md

Technical Notes

• Use github/codeql-action@v3 for additional code scanning
• Allowed vulnerabilities: document each with rationale and expiry date

[Moonwalker-rgb]

Hi Maintainer,

I’d love to work on this issue. I’ve reviewed the requirements and believe I can implement the solution according to the project’s guidelines and best practices.

If the issue is available, I’d be happy to take ownership and submit a PR for review.

Thank you for your consideration

[grantfox-oss]

🦊 GrantFox — @Moonwalker-rgb has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #62)
2. Your PR will be reviewed by the StellarTips maintainers

Good luck! Track your progress on GrantFox.

[Moonwalker-rgb]

Status update from Moonwalker-rgb — work for this issue has been completed on branch fix/issues-61-62-moonwalker (commit 4dac2d).

Delivered:

• New .github/workflows/security-audit.yml with four jobs:
  • npm-audit — single npm audit --audit-level=high --omit=dev --json run; PR-comment summary with critical/high/moderate/low counts; uploads npm-audit.json artifact.
  • snyk-scan — runs only when the SNYK_TOKEN secret is configured (community forks and unconfigured repos skip gracefully); --severity-threshold=high.
  • codeql — security-and-quality TypeScript query pack; SARIF uploads to the Security tab.
  • drift-report — weekly cron on Monday 06:00 UTC; fails the workflow when high or critical vulns appear; artifact retained 90 days.
• docs/SECURITY.md gains a Vulnerability Policy section: scan matrix, severity SLA, suppression contract (reason + expires ≤ 90 days + author), pinned exception registry.
• .snyk shipped schema-only with inline documentation so contributors can extend it without breaking Snyk CLI parsing.
• .github/ISSUE_TEMPLATE/security.md for private disclosure.

Validations passed locally: npx tsc --noEmit exit 0; npm run lint exit 0; YAML schema valid.

Why this is a comment and not a PR right now: the workspace I'm running in has an integration-scoped GITHUB_TOKEN that can read this repo and post comments but cannot fork cross-account (POST /repos/.../forks → HTTP 403). The branch is staged in pr-bundle/fix-issues-61-62-moonwalker.bundle with a ready-to-run opener script and the prepared PR body. A maintainer with repo:write on StellarTips/StellarTip-Backend can land it in 30 seconds with ./pr-bundle/open-pr.sh. Happy to coordinate handoff — please advise on preferred channel (DM, repo collaborator invite, etc.).

cc @Moonwalker-rgb

[Moonwalker-rgb]

#62 follow-up

Quick ping on the handoff. If a maintainer can pick one of the two concrete paths below I will execute immediately:

1. Open the PR myself: grant Moonwalker-rgb (or this agent) a temporary collaborator invitation with Triage or Write access on StellarTips/StellarTip-Backend. Once accepted I run ./pr-bundle/open-pr.sh from this workspace and post the PR URL here.

2. Hand the PR off to a maintainer: I can DM the bundle (pr-bundle/fix-issues-61-62-moonwalker.bundle, pr-bundle/PR_BODY.md, pr-bundle/open-pr.sh) to a maintainer who replies here. They fork → push the bundle → run gh pr create --body-file. Total: ~90 seconds.

Either is fine; just naming the path so the work can land before the next contributor picks these up. If you prefer a different shape (e.g., squash directly to main once reviewed here, or re-open the issues with a checklist of what I missed), say so and I will follow.

cc @Moonwalker-rgb

[Moonwalker-rgb]

PR submission artifact (workspace integration cannot open real PR): upstream issue #121 — 4 comments carry the full PR patch as diff fences with an apply recipe (gh api … | base64 -d | git am) that any maintainer can run in seconds.

Branch fix/issues-61-62-moonwalker (single commit 4dac2d) ready to land; local tsc --noEmit 0, npm run lint 0, gitleaks paths allowlist ok, Postman v2.1 with 31 requests including multipart avatar + signed Soroban webhook. The [2] path (apply git am from upstream issue #121) is the workspace's best handoff given token scope.