Last stretch before Swell. Make Waves closes September 21 and our hackathon app has run it end to end. August was the security month: an incident hit our GitHub organization, was contained, and the response rebuilt how the whole fleet is deployed and accessed. Underneath, xrpl-connect shipped v1, the payment gateway's rebuilt payout engine is deployed and in final testing, and the website migration landed with an editing workflow.
- Core-dev bootcamp in progress: full pass done, requirements modules reviewed
- Make Waves ends Sep 21, run on the hackathon app throughout
- Swell invitation cards: one day in, almost done
- Hackathon app: breakout rooms in final testing for Swell
- New York: core-dev live on the academy, hackathon, Swell talks and a 10-minute product demo
- Secrets left GitHub: one deploy tool, one contract per app
- Signed commits, manual deploys, tailnet-only SSH on every host
- xrpl-connect v1 published and hardened
- Payment gateway payout engine rebuilt, deployed, in final testing
- Website refresh in the works: edit in place on staging, auto-committed, merged by a tech admin
Since the last committee
Days of activity from July 24 to September 2, 2026. Each box is one calendar day, shaded by that day's commit volume; the number on the right is the count of distinct active days.
go-xrpl, xrpld-rust) lives outside it.
The path to Swell
Make Waves has run on the hackathon app since June with no structural change needed. The core-dev bootcamp continues on the academy. What remains is the close of the build window and New York.
Complete pass done; requirements modules reviewed. Content work continues.
Judging gated on mainnet validation; metrics feed a spreadsheet directly.
The summer build window closes.
Core-dev live on the academy, the hackathon, Swell talks. Invitation cards almost ready.
Hackathon app: supporting Make Waves, gearing up for Swell
August work was operational and security-driven: an audit log of privileged admin writes, per-device session secrets, a mainnet-validation gate enforced on judging and admin ranking, duplicate-project merging, a prize layout redesigned by sponsor, and program metrics exposed as spreadsheet CSV feeds so reporting no longer needs a developer. Next, for Swell: finalize testing of the breakout room feature and a few further improvements.
Swell invitation cards
A standalone app generates a personal invitation card for the Swell hackathon from the designer's template: photo upload and cropping, share flows for X and LinkedIn, a permalink per card. Built by Nada: one day in, almost done. Deliberately independent of every other app.
Academy: content
The core-dev bootcamp is still in progress: a complete pass is done and the review of the requirements modules is complete. Ongoing academy work is mostly content; the platform was quiet on main in August, with sandbox and MCP work continuing on branches. In-person core-dev in New York runs on the platform.
Swell slate
- Thomas, 10 minutes: the new client. Set.
- Product demo, 10 minutes. Question for the committee: what do we cover?
- Luc's talk, proposed: XRP Identity, a unified login for the ecosystem. Live in all our apps today: use it from learn.xrpl.org to hackathons, and on news and the academy to save your progress. A modern OpenID implementation. If agreed, there is a line of work to make it robust enough for public consumption, and an update to agentic flows is in development: BYOAI is a reality per app, testable on the academy; the next step is to make it multi-app.
Security: the incident and what it changed
What happened. Between July 16 and August 8 an attacker used a compromised developer GitHub credential to push malicious GitHub Actions workflows to 18 of our repositories. The workflows read repository secrets and sent them out. No application code was modified and nothing reached any main branch. The activity was spotted on August 8, the compromised dev box was taken offline the same evening, and exposed credentials were rotated.
Post-mortem: Incident report (PDF) ↗ · en français ↗ · Incident analysis, from the GitHub audit logs ↗. Highlights:
- The vector was a GitHub CLI OAuth token, created legitimately by
gh auth loginon July 1 withrepoandworkflowscopes. Not a personal access token, not an SSH key, not the orchestrator OAuth app. - The compromise started July 16, eleven days before the first payload: the token deleted a workflow run to erase traces. The exposure window is recalculated from that date.
- The July 28 cleanup missed it. Thirteen third-party authorizations were revoked that day; GitHub CLI was not among them. The token stayed valid 28 more days, the exact window of the second payload. Destroyed August 25, forty days after first malicious use.
- The token lived on a shared remote development host, not the laptop. That host is used by other team members and is the first place to inspect.
- Lesson:
gh auth logingrantsworkflowby default, andworkflowis what made both payloads possible. Log in with--scopes repoand re-authorize only when needed.
Action items
- Notify our users that their data may have been exposed: essentially name and email. Owner and wording to agree today.
- Inspect the shared remote dev host; request a fresh org audit-log export (the current one stops July 28); recover the workflow run deleted July 16.
- Confirm closed: stale Tailscale auth key revoked; orchestrator GitHub OAuth app deleted.
Why write access was enough. Any workflow pushed to a repo can request that repo's Actions secrets. Our deploy model kept secrets in GitHub Actions, so one stolen login exposed the fleet's credentials.
What changed in August
- Secrets left GitHub entirely. A new deploy tool (
gh deploy-setup) deploys every app to DigitalOcean App Platform with a strict split: git holds only the env-var contract, Passbolt holds every value, DigitalOcean holds the live spec. Rotate a provider's keys across every app in one pass; audit drift; see who uses what. - Every app got an env contract. hackathon, academy, glow, Map, portal, payment gateway and pulse trimmed to a minimal, annotated contract with no legacy fallbacks. Unauthenticated environment-dump endpoints found in three apps were removed.
- Org policy. Signed commits enforced by an org ruleset. CI on main removed org-wide; deploys are triggered by hand. A detective control on forge scans every merge to main on the agent-loop repos and reports anything suspicious, with a daily heartbeat.
- Hosts. Tailnet-only SSH is the default for every managed host; authorized keys are owned exclusively by Ansible and unmanaged keys purged.
- App-level fixes in the same sweep. Portal passkeys and quest claims, hackathon roles, xrpl-connect wallet-connector XSS sinks and Crossmark sign-in, payment gateway OAuth moved server-side and payout custody protected across rotation and deploy.
Forge v2 retired. The orchestrator presented in July as the next pipeline was stood down on July 31; its dev box was the secondary intrusion vector. Agent work continues on the original forge supervisor, VPN-only, with the observer above as the watch.
Products
xrpl-connect: v1 shipped, then hardened ↗
Published under XRPL Commons on August 18 with versioned release documentation. Since: coordinated release workflows, React 18 and 19 compatibility with an awaitable modal API, the same for Vue, a type-safe wallet registry and customization contract, Ledger multisigning, authoritative wallet networks, and a Xaman bundle fix for Nuxt. Ready to position as the builder tool for Swell.
Payment gateway: deployed, in final testing ↗
The Temporal worker is gone. The payout engine is now a state machine inside admin with per-admin recovery keys, encrypted offline recovery, atomic recovery challenges, and a rule to never conclude an unobserved payment failed. Deployed to its droplet and in final testing. Next: wire it to hackathon prize disbursement for Swell.
Website refresh, led by Nada ↗
Less important than the above, but in the works. Preview at website.xrpl-commons.org: a clean repo cut from the Webflow migration, 269 content files in typed collections, about 40 pages, redirects for legacy URLs, images shrunk from 759 MB to 91 MB. The editing logic: staging.xrpl-commons.org is the same website with edit rights. Editors change content in place, every change is committed automatically to source control, and a tech admin merges it to production.
Portal ↗
A six-PR security batch on August 24. No new product surface this month; the liquidity router naming question from July is still open.
Academy and serious game
The academy was quiet on main after the bootcamp closed (env contract only); sandbox and MCP work continues on branches, and in-person core-dev in New York runs on the platform. The serious game (Mathis) got a refactor and XRP Identity integration on September 1.
For discussion: Sites, an internal static publisher
One place for anyone in the company to publish a static site from a browser: drag a folder, live in seconds at <name>.sites.xrp.lc, with public, company-only or allowlisted access, one-click rollback and an audit log. It replaces the static role of the shared hosting being deprecated, and would be the natural home for this steering site, whose old deploy pipeline died in August. A dedicated droplet, about $12 a month. Too short to present today: the spec note is shared for comment, and the go/no-go is for the next committee.
Clients, infrastructure, amendments
Validator cluster moved to xrpld
The cluster migrated from rippled to xrpld: install-only mode with config out of band, a dedicated UNL validator host, node identity on the host with explicit rotation, monitoring key out of the repo. EVM sidechain validators (mainnet and testnet v2) added and moved to tailnet SSH.
Go and Rust clients: both syncing on testnet
A milestone for the two-client story. Thomas presents the new client in his 10-minute Swell slot.
Amendments
One commit on the harness since July: coverage paused during the security month. The XLS-66 vote timing is still tied to rippled 3.4. Resume before the next voting session.