Security overhaul: consolidated hardening of the key-holding signer (consent UI, session-only key, NIP-44, NIP-98 replay fix, CI)#22

Merged

jjohare merged 34 commits into

JavaScriptSolidServer:mainfrom

jjohare:chore/podkey-up-to-scratch

Jun 15, 2026

Commits on May 12, 2026

fix: remove duplicate fetch/XHR interception from content script

DreamLab-AI Mega-Sprint
and
ruvnet
committed
security: move private key from chrome.storage.local to chrome.storage.session

DreamLab-AI Mega-Sprint
and
ruvnet
committed
security: fix Solid server auto-trust hostname matching

DreamLab-AI Mega-Sprint
and
ruvnet
committed
security: remove NIP-98 signed event cache to prevent replay attacks

DreamLab-AI Mega-Sprint
and
ruvnet
committed
security: whitelist message types in content script relay

DreamLab-AI Mega-Sprint
and
ruvnet
committed
security: implement signing approval popup to replace auto-approve

DreamLab-AI Mega-Sprint
and
ruvnet
committed

Commits on Jun 14, 2026