mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
The kind:30175 content body is published unencrypted, so carrying env_vars there leaked any secrets a persona held (API keys, tokens) in plaintext to every relay and reader. Per NIP-AP, persona events are public configuration; secrets travel only via the NIP-44-encrypted mem/persona engram. persona_from_event now returns an empty env_vars map; engram instantiation is the sole secret path. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>