CI: No CODEOWNERS file and no secret scanning — PRs have no auto-reviewers and secrets can be committed silently

[k-deejah]

Difficulty: Advanced

Problem

1. No .github/CODEOWNERS file exists
GitHub cannot auto-assign reviewers for PRs touching critical paths (contracts/, sdk/, backend/src/services/, docker/). Any contributor can open a PR modifying contract source with no domain expert automatically notified. Required reviews cannot be enforced by code area without CODEOWNERS.

2. security-scan.yml has no secret scanning step
.github/workflows/security-scan.yml runs cargo-audit (Rust dependency vulnerabilities) and dependency-review (npm dependency vulnerabilities on PRs) but has no step that scans for accidentally committed secrets — API keys, private keys, AWS credentials, Stellar secret keys (S...), or JWT secrets in source files or commit history.

3. No branch protection rule documentation — the repository may have no required status checks
There is no CONTRIBUTING.md section, no docs/governance.md section, and no repo settings documentation specifying which CI checks must pass before merge. Without required status checks, a PR with failing tests can be merged by any repo admin.

Impact: Contract security vulnerabilities can be merged without expert review. A developer could accidentally commit a STELLAR_PRIVATE_KEY in a script or .env file. PRs with failing tests can bypass CI gates.

Proposed Solution

• Create .github/CODEOWNERS assigning contract owners to contracts/**, SDK owners to sdk/**, and security reviewers to docker/** and *.yml.
• Add trufflesecurity/trufflehog-actions-scan or gitleaks/gitleaks-action to security-scan.yml.
• Document required branch protection settings in CONTRIBUTING.md: required CI checks, required reviewers, no force-push to main.

Acceptance Criteria

• .github/CODEOWNERS created with owners for contracts/**, sdk/**, backend/**, docker/**, .github/workflows/**
• Secret scanning step added to security-scan.yml (trufflehog or gitleaks)
• Secret scanning runs on push to main and on PRs
• CONTRIBUTING.md documents required branch protection rules
• CONTRIBUTING.md documents required reviewer process via CODEOWNERS
• Secret scanner configured to fail on high-confidence secret findings

Contributor Note

If assigned, your PR must show a sample trufflehog/gitleaks run on the current repository (confirm no false positives from test keypairs), and explain the CODEOWNERS syntax for requiring review from multiple owners on high-risk paths.

[Hollujay]

i would like to work on this issue because I will get it done efficiently @k-deejah

[Jokay1997]

I have experience improving CI/CD security and repository governance through CODEOWNERS, automated reviews, and secret-detection tooling. I propose adding a CODEOWNERS file to automatically assign the appropriate reviewers and enabling secret scanning to detect exposed credentials before they become a security risk.

[grantfox-oss]

🦊 GrantFox — @Jokay1997 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #186)
2. Your PR will be reviewed by the Stellar-Deejah maintainers

Good luck! Track your progress on GrantFox.