1.0.0

First release. A small NIP-07 Nostr signer for Safari, Chrome, Brave, Edge and Arc.

No analytics, no accounts, no network requests of any kind. Your key is encrypted at
rest as a NIP-49 ncryptsec — a standard format, so the same string works with nak and
other NIP-49 tools.

Install

Safari (macOS): download mineracks-signer-1.0.0-safari-macos.zip, unzip, drag the app
to /Applications, launch it once, fully quit Safari (⌘Q) and reopen, then
Safari → Settings → Extensions → enable mineracks signer → set website access to Allow.
The app is signed with a Developer ID and notarized by Apple — Safari will not list an
extension whose containing app isn't.

Chrome / Brave / Edge / Arc: download mineracks-signer-1.0.0-chrome.zip, unzip, then
Extensions → Manage Extensions → Developer mode → Load unpacked → select the folder.

Verify what you downloaded against SHA256SUMS.txt.

Then

Click the ⚡ icon, paste your nsec (or a hex key, or an existing ncryptsec), set a
password. Check the npub it shows is the one you expect.

Notes

Tested end to end on Chromium by an automated suite (16 checks) and by hand on Safari 26.
No independent security audit — it's deliberately small enough to read yourself, and
you should before trusting it with a key that holds value.

The README documents eight gotchas that cost us real time; most apply to any Safari web
extension, not just this one.

desktop 0.1.0

The desktop signer — a NIP-46 remote signer with a GUI. Your Nostr key lives on your
own machine, unlocked with Touch ID, and signs for any app — browser, phone, another
computer — over a relay. The app that asks never sees your key, only the signature.

This is the companion to the browser extension (see the 1.0.0 release). Use the extension
for a signer inside one browser; use this for one key serving everything, including iOS
and Safari, where extensions barely exist.

Install (macOS, Apple Silicon)

Download the .dmg, drag the app to Applications, open it. It is signed with a Developer ID
and notarized by Apple, so Gatekeeper will not complain.

On first run: paste your nsec (or create a brand-new Nostr account in the app), set a
recovery password, and confirm with Touch ID. Then Go online and paste the bunker://
link it shows into any Nostr app.

Key custody

• The key is only ever handled in the Rust process — the UI never receives key material.
• At rest it is sealed as a NIP-49 ncryptsec twice: once under a random 256-bit key in
  the macOS Keychain (Touch ID gated) and once under your recovery password. Both open the
  same key, so unlock methods can be added or revoked without re-encrypting anything.
• Every request shows the app and what it wants. Auto-approve is opt-in per app, revocable.
• No analytics, no accounts. Network traffic is NIP-46 relay chatter plus an optional public
  profile lookup.

Known limits — please read

• Apple Silicon only. No Intel build yet.
• Windows is not packaged. Windows Hello support is written but the secure-storage path
  is not implemented; it fails with a clear message rather than silently.
• Touch ID is currently app-enforced, not bound to the Keychain item's access control.
  That upgrade is next.
• No independent security audit. It is small enough to read — please do, before trusting
  it with a key that holds value.

Verify your download against SHA256SUMS-desktop.txt.