Security is paramount for NostrBridge, as the system handles private keys (NSECs), NIP-98 authentication signatures, webhook execution rules, and payment integrations.

If you discover a potential security vulnerability in NostrBridge, please DO NOT open a public GitHub issue.

Instead, please report vulnerabilities via:

1. GitHub Private Vulnerability Reporting: Submit a disclosure report directly through the repository's Security tab under Advisories.
2. Security Email: Contact the security team privately at security@nostrbridge.com (or project maintainers).

• Detailed description of the vulnerability and potential impact.
• Steps to reproduce or a Proof of Concept (PoC).
• Affected endpoints or components (e.g., API router, signer module, NIP-98 validation).
• Any suggested remediations or mitigations.

• We will acknowledge receipt of your report within 48 hours.
• We will keep you updated on progress towards resolving the issue.
• Once fixed, we will publicly release a security advisory giving credit to the reporter (if desired).

When self-hosting NostrBridge on your own Cloudflare account:

1. NSEC Cryptographic Protection:
   • Never commit raw private keys (nsec...) or secrets into git repositories or .env files.
   • Use Cloudflare Secret environment variables (wrangler secret put) or AES-256 encrypted D1 fields.
2. NIP-98 Gating:
   • Ensure all non-webhook API endpoints are protected by NIP-98 HTTP header authentication (Authorization: Nostr ...).
3. Environment Isolation:
   • Keep development secrets (.dev.vars) separate from production Cloudflare environment variables.
4. Dependency Auditing:
   • Regularly run pnpm audit to check for downstream package vulnerabilities.