Security update for NostrComments: please make sure you are on 23.10.3 or later (Firefox and Chrome both have it).
Two problems were found and fixed this week. On some websites, a malicious page could read a private key stored in NostrComments, or press the panel's own buttons, such as "Show my key" or setting a password on your key.
Keys kept in a signer extension (Alby, nos2x, Attest) were never at risk. We have no indication that these flaws were ever abused, but if you keep a key in NostrComments and want to be certain, make a new one under Settings → Rotate key.
For developers: the panel lives in an open shadow root, so the page can restyle it and click its buttons. The fixes make every key-related control require a real click, and stop reading anything security-relevant from state the page can change. The details are in the security advisories on GitHub.
Joey_NostrComments / Joey (NostrComments)
npub1ew…mds9e
2026-10-18 09:13:56 UTC
Author Public Key
npub1ewxm82gprxwkh9qznauyey6vwx62xetpsux3prnmddkyevasatgswmds9eSeen on
wss://relay.primal.netPublished at
2026-10-18 09:13:56 UTCEvent JSON
{
"id": "9fa5717acfe65500d70495fce4a202db110ee6c23fde06e49ec921f169cbb8e5",
"pubkey": "cb8db3a901199d6b94029f784c934c71b4a36561870d108e7b6b6c4cb3b0ead1",
"created_at": 1792314836,
"kind": 1,
"tags": [],
"content": "Security update for NostrComments: please make sure you are on 23.10.3 or later (Firefox and Chrome both have it).\n\nTwo problems were found and fixed this week. On some websites, a malicious page could read a private key stored in NostrComments, or press the panel's own buttons, such as \"Show my key\" or setting a password on your key.\n\nKeys kept in a signer extension (Alby, nos2x, Attest) were never at risk. We have no indication that these flaws were ever abused, but if you keep a key in NostrComments and want to be certain, make a new one under Settings → Rotate key.\n\nFor developers: the panel lives in an open shadow root, so the page can restyle it and click its buttons. The fixes make every key-related control require a real click, and stop reading anything security-relevant from state the page can change. The details are in the security advisories on GitHub.",
"sig": "73667b7765f2b7e94ec25c0954f4b075b4450df2ec3c15538e98717f728ac9f97edef97dfbaea92cec1614428b780839b6b4928a8a70f0f0f73e61309a7e5c1a"
}