scripts/deploy.mjs accepts the signer's secret key as a plain CLI argument

[chonilius]

scripts/deploy.mjs reads the deployer's Stellar secret key from process.argv[2] (const deployerSecret = process.argv[2];), per the documented usage: node deploy.mjs <secret> <wasm-path> [name]. Passing secret key material as a CLI argument means it lands in shell history (.bash_history/.zsh_history) and is visible to any other local process via ps aux / /proc/<pid>/cmdline for the duration of the run — a well-known anti-pattern for anything security-sensitive, and notably worse here than a typo'd password since this key can move real, deposited sponsor/treasury funds once contracts are initialized.

The README's own "Deployed on Stellar testnet" section documents exactly this invocation pattern (node scripts/deploy.mjs <SECRET_KEY> ...) as the recommended fallback when stellar-cli's network access is broken, so this isn't a hypothetical misuse — it's the documented happy path. Prefer reading the secret from an environment variable (e.g. MERGEFI_DEPLOYER_SECRET) or prompting for it interactively (masked input) instead.

[sulaimonifeoluwa4-blip]

@sulaimonifeoluwa4-blip has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi can I work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @sulaimonifeoluwa4-blip to this issue.

[toxxxxicc]

@toxxxxicc has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

hello miantainer, i would like to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @toxxxxicc to this issue.

[drips-wave]

Congratulations, @toxxxxicc! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @toxxxxicc: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊