NostrKeep Signer for iOS is a Nostr key backup and signer app — it stores private keys (nsec) in the iOS Keychain, shares them with the NostrKey Safari extension via App Groups, and signs events. Security reports are taken seriously and handled with priority.

Always run the latest version. Security and key-handling fixes ship in the newest App Store release. Keep automatic app updates enabled.

Please report security issues privately — do not open a public GitHub issue.

• Preferred: GitHub private vulnerability reporting ("Report a vulnerability").
• Or email security@humanjava.com with details and reproduction steps.
• For sensitive reports, you may encrypt to the maintainer's Nostr key (NIP-44 DM); request the current npub in your first email.

Please include:

• A clear description and the impact (what an attacker could do).
• Steps to reproduce, or a proof of concept.
• Affected app version, iOS version, and device.

• Acknowledgement within 3 business days.
• An initial assessment and severity within 7 business days.
• Coordinated disclosure: we'll agree a timeline with you before any public detail (App Store review time is factored into the fix window), and credit you (if you wish) once a fix ships.

Security fixes target the latest version on the App Store. Older versions are not patched — please update before reporting.

• The Keychain / App Groups boundary (how key material is stored and shared with the extension) is the core security surface — reports there are in scope and high priority.
• The WKWebView bridge (ios-polyfill message handlers) is in scope: any way web content can reach key material or signing without user consent.
• Vulnerabilities in dependencies should go to the upstream project first; tell us too if this app's usage makes it exploitable.