From 6aab5143bc686a5846fda753993174b3b403d83a Mon Sep 17 00:00:00 2001 From: Muhammad Dzakwan Najmi Date: Thu, 8 Oct 2026 15:03:41 +0800 Subject: [PATCH] docs(security): link the MPP-01 advisory GHSA-wm3g-w88q-73xx is published for the MPP-01 network issue in 0.6.0 and earlier, so SECURITY.md names it where it describes the issue and where it says which versions have an advisory. Co-Authored-By: Claude Opus 5.5 --- SECURITY.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index cee743a..6cdcb3d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -28,7 +28,8 @@ pays once per run. Before 0.7.0, `MPP-01` let the SDK sign for whichever network the challenge named, through the SDK's default endpoint for it, so a target asking for `stellar:pubnet` could have a mainnet transfer signed by the payer key if that account holds mainnet funds (read from the SDK's source, not -run). Use a payer key that has never held mainnet funds. +run). Use a payer key that has never held mainnet funds. The advisory is +[GHSA-wm3g-w88q-73xx](https://github.com/wasit-dev/wasit/security/advisories/GHSA-wm3g-w88q-73xx). ## Authorization @@ -201,7 +202,8 @@ arrive by two routes: `@stellar/mpp`, `@x402/stellar` and the three `@wasit-dev/*` packages appear in that count only because npm marks a package that depends on an affected one. There is no advisory against Wasit 0.7.0's own code; versions up to 0.6.0 have -the `MPP-01` network issue described under [Testnet only](#testnet-only). +the `MPP-01` network issue described under [Testnet only](#testnet-only), +[GHSA-wm3g-w88q-73xx](https://github.com/wasit-dev/wasit/security/advisories/GHSA-wm3g-w88q-73xx). There is no downstream fix. The levers are `@stellar/mpp`'s two peer ranges, reported upstream as