diff --git a/ZAPSTORE.md b/ZAPSTORE.md
index 892f0df..0c75f75 100644
--- a/ZAPSTORE.md
+++ b/ZAPSTORE.md
@@ -204,9 +204,12 @@ export PATH=$PATH:$(go env GOPATH)/bin
 ## Step 8 — Publish to Zapstore
 
 ```bash
-SIGN_WITH=nsec1skg6sa4eqxgy6g4tauhfhf5vs4v89ja76mxgajc770jqf7jquqjq2pt8z7 zsp publish --wizard
+SIGN_WITH=nsec1... zsp publish --wizard
 ```
 
+> ⚠️ **Never commit your nsec.** Always pass it inline at runtime via the
+> `SIGN_WITH` env var, and never paste it into any tracked file.
+
 The wizard will:
 1. Ask for your APK path → point to `android/app/build/outputs/apk/release/app-release.apk`
 2. Link your APK signing certificate to your Nostr identity (one-time NIP-C1 proof)