Add a `docs/AUDIT_PREP.md` checklist for security audits

[Baskarayelu]

Summary

What to hand the auditor, what to expect, what to fix pre-audit.

Background

We rely on this information internally but it is currently tribal knowledge. Writing it down lets reviewers verify behaviour against the documented intent, lets new contributors get productive without reading every commit, and lets the support team answer common questions without paging an engineer.

Acceptance criteria

• The change matches the summary above.
• The new document is linked from at least one existing top-level doc (README or docs/README).
• Examples in the document compile / run if applicable.
• Lint, type-check, and tests all pass locally.
• PR description references this issue with Closes #<this-issue>.

Implementation hints

• Audience: pick one (contributor / operator / downstream integrator) and write for them; do not try to address all three in the same doc.
• Prefer concrete examples over abstract definitions. Show a real entrypoint, request, or output rather than foo() placeholders.
• Cross-link from the README and from any related doc; orphaned docs rot fastest.
• Where the project ships generated docs (rustdoc, JSDoc, OpenAPI), keep this new content discoverable from the same starting point.

Repo-specific notes

• This is a Soroban contract crate. Run cargo build --target wasm32-unknown-unknown --release to verify the change still builds for WASM.
• Run cargo test -p <package> for the affected crate, and cargo clippy --workspace --all-targets -- -D warnings before pushing.
• Keep #![no_std] discipline: do not introduce std:: calls; use soroban_sdk primitives.

Out of scope

• Unrelated refactors in adjacent files.
• Stylistic-only changes (formatting, renaming) that are not required by the fix.
• Anything beyond the acceptance criteria above; surface follow-ups as separate issues.

How to claim and submit

1. Comment on this issue saying you'd like to take it on; wait for a maintainer to assign you (avoids duplicated effort).
2. Open a PR that references this issue (Closes #<this-issue>).
3. Make sure CI is green and request review from a CODEOWNERS maintainer.
4. PRs that close this issue and pass review may qualify for a reward — see the MAYBE REWARDED label and the FWC26 campaign page.

---

Category: documentation  ·  Campaign: GrantFox OSS · Official Campaign | FWC26 · Maybe Rewarded

[CyberXpert607]

@CyberXpert607 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hey team,

I'd like to take #1916.

This is a valuable documentation task that turns tribal knowledge into an actionable checklist making audits smoother, onboarding faster, and security posture clearer. I'll write a practical AUDIT_PREP.md with what to hand the auditor, what to expect, what to fix pre-audit, and concrete examples. I'll also link it from the README to ensure discoverability.

Full cargo build --target wasm32-unknown-unknown --release, tests, and clippy clean.

Please assign me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @CyberXpert607 to this issue.

[drips-wave]

Congratulations, @CyberXpert607! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @CyberXpert607: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[Baskarayelu]

@CyberXpert607 welcome aboard — this issue is yours.

When you're ready, open a PR with Closes #1916 in the body. If anything's unclear about scope or the acceptance criteria, ask in Discord: https://discord.gg/WC53JxDqx

[blurbeast]

@blurbeast has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

hello my Chief, can i jump on this please ??

ℹ️ Repo Maintainers: To accept this application, review their application or assign @blurbeast to this issue.

[Baskarayelu]

@CyberXpert607 welcome aboard — this issue is yours.

When you're ready, open a PR with Closes #1916 in the body. If anything's unclear about scope or the acceptance criteria, ask in Discord: https://discord.gg/WC53JxDqx

[grantfox-oss]

🦊 GrantFox — @blurbeast has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #1916)
2. Your PR will be reviewed by the QuickLendX maintainers

Good luck! Track your progress on GrantFox.