diff --git a/package-lock.json b/package-lock.json
index 2c5a6bf..a9d52ad 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "skate-spots",
-  "version": "1.7.78",
+  "version": "1.7.79",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "skate-spots",
-      "version": "1.7.78",
+      "version": "1.7.79",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@bitcoinerlab/secp256k1": "^1.2.0",
diff --git a/package.json b/package.json
index 49b9f06..381b74a 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "skate-spots",
   "private": true,
-  "version": "1.7.78",
+  "version": "1.7.79",
   "license": "AGPL-3.0-only",
   "type": "module",
   "homepage": "https://skate-spots.org",
diff --git a/release-notes.txt b/release-notes.txt
index 35b1b9e..b529ba7 100644
--- a/release-notes.txt
+++ b/release-notes.txt
@@ -1,3 +1,16 @@
+🔐 Nsec is no longer stored persistently
+- Raw nsec logins now live only in sessionStorage. Reloading the tab keeps the
+  session; closing the browser/app requires re-entering the key.
+- Existing raw nsec entries are migrated out of localStorage on the next write.
+- The login warning now says this explicitly and points to Amber/bunker for
+  staying signed in. Added a regression test that asserts no `nsec1` value lands
+  in persistent localStorage.
+- Direct links to `/spot`, `/crew`, `/event`, `/listing`, `/card` and similar
+  paths now rewrite into the HashRouter before React mounts, including cold
+  native App Links.
+
+---
+
 👛 Built-in wallet first on mobile
 - On the native app, the Wallet page and wallet manager now lead with the
   built-in SkateSpots ecash wallet. Connecting an existing Lightning wallet is