Sidecar | A Classy Nostr Signer Chrome extension security report

Sidecar — A Classy Nostr Signer Sidecar lives in your browser’s side panel and hands every Nostr web app a secure window.nostr to sign in with — so you never paste your nsec into a website again. Your keys stay on your device, encrypted behind a PIN. It’s a companion to your favorite Nostr client, not a replacement: sign, post, and zap in a tap, then jump right back to the app you love. 🔑 Your keys, your control Full NIP-07 signer: getPublicKey, signEvent, NIP-04 & NIP-44 encrypt/decrypt, and your relay list. Private keys are encrypted at rest (PBKDF2 → AES-GCM via WebCrypto) — never stored in plaintext, never transmitted off your device. PIN-protected (at least 8 characters, with a live strength check) and automatic re-lock. A paste guard blocks dropping an nsec anywhere except the import field. Multiple accounts — store as many keys as you like, switch the active one in a click, drag to reorder. Each site stays pinned to the account it logged in with, so there’s no identity mix-up. Per-site permissions with a clear prompt that previews exactly what you’re signing. Relay auth (NIP-42) signs automatically so clients stay connected. 👤 Your profile, your way View and edit your profile, see your following count, and publish updates in a tap. Edit and publish your outbox relays (NIP-65) right from your profile. Follow-list recovery — if another app wipes or shrinks your follows, scan your relays and restore a healthy earlier version (powered by Mutable). ✍️ Post without leaving the page A composer for notes with @mention autocomplete that searches your follows and all of Nostr, embedded note previews (now with mentions and media), link cards, and image/video upload (to your own Blossom servers, with an automatic fallback). Drafts autosave per account, and a short review countdown lets you read the note exactly as it’ll publish before it sends. 🔔 Notifications at a glance A bell shows replies, mentions, reposts, reactions, and zaps for your active account — each with a tap-through that opens it in your preferred web client. Muted accounts (public and private) are filtered out. ⚡ Lightning wallet (Nostr Wallet Connect) Connect any NWC wallet — Alby Hub, Zeus, YakiHonne, Coinos, Minibits and more — with built-in suggestions to help you pick one. Send (BOLT11 or Lightning address), receive by invoice or by your Lightning address (with a QR), view history, and back up or export your connection (PIN-gated, with a QR). Pay a Lightning invoice from any Nostr page in a tap, plus a WebLN provider with optional per-site spending budgets you can edit or revoke any time. Sidecar never holds your funds — you stay in control of your own wallet. 🛡️ Private by design Open source. No analytics, no tracking, no remote code — everything runs locally in your browser. Link previews are fetched with a guard against private-network requests. Works in Chrome, Brave, Edge, and other Chromium browsers. Pin Sidecar, open the side panel, and you’re ready. 🍸 🗞️ What’s new 1.2.0 • @mention anyone on Nostr — search the whole network, not just the people you follow • Lightning address on the Receive screen and wallet page (with QR), plus a one-tap prompt to match your profile address to your wallet • Guided setup for new accounts — add a name, photo, and bio in a few taps • Follow-list recovery — restore an earlier version of your follows if another app wiped them (powered by Mutable) • Outbox relays (NIP-65) — view, edit, and publish your relay list from your profile • Quoted notes now show mentions and media in previews • Security hardening — 8-character minimum PIN with a live strength check, tighter relay-auth signing, and SSRF-guarded link previews • Refreshed in-app Nostr app directory, plus lots of polish and fixes 1.1.0 • Notifications bell — replies, mentions, reposts, reactions, and zaps, with mute filtering • Blossom media uploads (with nostr.build fallback) • Export your wallet connection string (PIN-gated, with a QR); QR on nsec reveal for mobile sign-in • Wallet suggestions to help newcomers get an NWC wallet • Composer draft autosave + a review countdown • Polished first-run welcome experience