Nsec Oracle is a server-side Nostr signing oracle for LNbits extensions and admin-key API clients: encrypted key vault, per-key/per-kind permissions with rate limits, NIP-04/44 encrypt-decrypt, signing-requirement discovery, and an audit log. Formerly published as 'nsecbunker' — on upgrade (PostgreSQL) the first migration adopts the old schema so keys and grants carry over. External NIP-46 remote signing is served by the separate lnbits/nostr_bunker extension.