docs(security): STRIDE threat model reference page (#85)

contracts/stellar/audits/2026-06-sac-compatibility.md

@@ -173,3 +173,10 @@ USDC and EURC (Circle) are fully compatible with stealth-sender and stealth-addr
 Assets with `AUTH_REQUIRED` are incompatible with stealth payment flows — the issuer cannot pre-authorize an address that doesn't exist yet. Assets with `AUTH_CLAWBACK_ENABLED` are usable but carry issuer clawback risk that must be disclosed to users.
 
 The Wraith SDK and agent surface these warnings automatically.
+
+---
+
+## See Also
+
+- [Threat Model](/reference/threat-model) — full STRIDE analysis for all Wraith Protocol contracts, including residual risk R-05 which covers the SAC flag hazards documented here
+- [Privacy Best Practices](/guides/privacy-best-practices) — withdrawal timing, amount hygiene, and address reuse guidance

docs.json

@@ -89,7 +89,7 @@
           },
           {
             "group": "Contracts",
-            "pages": ["contracts/evm", "contracts/stellar", "contracts/solana", "contracts/ckb", "reference/stellar-event-schemas"]
+            "pages": ["contracts/evm", "contracts/stellar", "contracts/solana", "contracts/ckb", "reference/stellar-event-schemas", "reference/threat-model"]
           }
         ]
       },