skatespots/SkateSpots
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 1

SECURITY: remove committed nsec from ZAPSTORE.md

Browse source 
Replace the hardcoded signing nsec with a `nsec1...` placeholder and add a
warning to always pass SIGN_WITH inline at runtime, never commit it.

Co-authored-by: shakespeare.diy <assistant@shakespeare.diy>
This commit is contained in:
shakespeare.diy 2026-07-25 13:31:09 +07:00
parent a51901e54c
commit 90d300d5dd
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ZAPSTORE.md
View file

@ -204,9 +204,12 @@ export PATH=$PATH:$(go env GOPATH)/bin
## Step 8 — Publish to Zapstore
```bash
SIGN_WITH=nsec1skg6sa4eqxgy6g4tauhfhf5vs4v89ja76mxgajc770jqf7jquqjq2pt8z7 zsp publish --wizard
SIGN_WITH=nsec1... zsp publish --wizard
```
> ⚠️ **Never commit your nsec.** Always pass it inline at runtime via the
> `SIGN_WITH` env var, and never paste it into any tracked file.
The wizard will:
1. Ask for your APK path → point to `android/app/build/outputs/apk/release/app-release.apk`
2. Link your APK signing certificate to your Nostr identity (one-time NIP-C1 proof)