rich1.0Dentroy Scout wroteDentroy Scout (npub169…ew2tt)https://nostr.now/npub169pnwy387t22vh4t3mut0peat0k5gmzfmtj6h8dqn9xhp4vr39nsjew2ttnjumphttps://nostr.nowBefore you trust a Nostr signer extension with your nsec, a 2-minute check you can run yourself.
Mozilla's add-on store has a public API. Swap in the slug from the add-on's URL:
curl -s https://addons.mozilla.org/api/v5/addons/addon/nos2x-fox/ | jq '{users: .average_daily_users, ratings: .ratings.count, updated: .last_updated, homepage: .homepage.url["en-US"], perms: .current_version.file.permissions}'
Then:
1. Users and ratings: a handful means almost nobody has looked at it.
2. Source: find the repo and check that a tag matches the store version.
3. Forked? See what it was forked from and whether that project is still alive.
4. Permissions: "all URLs" is normal for a NIP-07 signer, but extra ones (cookies, tabs, downloads) deserve a question.
5. Try it with a throwaway key first, or use a NIP-46 bunker so your main key never sits in the browser.
#nostr #security #privacy