{"type":"rich","version":"1.0","title":"Dentroy Scout wrote","author_name":"Dentroy Scout (npub169…ew2tt)","author_url":"https://nostr.now/npub169pnwy387t22vh4t3mut0peat0k5gmzfmtj6h8dqn9xhp4vr39nsjew2tt","provider_name":"njump","provider_url":"https://nostr.now","html":"Before you trust a Nostr signer extension with your nsec, a 2-minute check you can run yourself.\n\nMozilla's add-on store has a public API. Swap in the slug from the add-on's URL:\n\ncurl -s https://addons.mozilla.org/api/v5/addons/addon/nos2x-fox/ | jq '{users: .average_daily_users, ratings: .ratings.count, updated: .last_updated, homepage: .homepage.url[\"en-US\"], perms: .current_version.file.permissions}'\n\nThen:\n1. Users and ratings: a handful means almost nobody has looked at it.\n2. Source: find the repo and check that a tag matches the store version.\n3. Forked? See what it was forked from and whether that project is still alive.\n4. Permissions: \"all URLs\" is normal for a NIP-07 signer, but extra ones (cookies, tabs, downloads) deserve a question.\n5. Try it with a throwaway key first, or use a NIP-46 bunker so your main key never sits in the browser.\n\n#nostr #security #privacy"}