From 90d300d5ddadbefa541c122476cb76b45fd68df2 Mon Sep 17 00:00:00 2001 From: "shakespeare.diy" Date: Sat, 25 Jul 2026 13:31:09 +0700 Subject: [PATCH] SECURITY: remove committed nsec from ZAPSTORE.md Replace the hardcoded signing nsec with a `nsec1...` placeholder and add a warning to always pass SIGN_WITH inline at runtime, never commit it. Co-authored-by: shakespeare.diy --- ZAPSTORE.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ZAPSTORE.md b/ZAPSTORE.md index 892f0df..0c75f75 100644 --- a/ZAPSTORE.md +++ b/ZAPSTORE.md @@ -204,9 +204,12 @@ export PATH=$PATH:$(go env GOPATH)/bin ## Step 8 — Publish to Zapstore ```bash -SIGN_WITH=nsec1skg6sa4eqxgy6g4tauhfhf5vs4v89ja76mxgajc770jqf7jquqjq2pt8z7 zsp publish --wizard +SIGN_WITH=nsec1... zsp publish --wizard ``` +> ⚠️ **Never commit your nsec.** Always pass it inline at runtime via the +> `SIGN_WITH` env var, and never paste it into any tracked file. + The wizard will: 1. Ask for your APK path → point to `android/app/build/outputs/apk/release/app-release.apk` 2. Link your APK signing certificate to your Nostr identity (one-time NIP-C1 proof)