Perfiles verificables con badges de reputacion sobre Nostr. Nunca mas un come empanadas se hace pasar por alguien de la comunidad.
Real scams happen in our community. We stop them with verifiable Nostr identity.
Earn badges through real participation. Build trust one event at a time.
Proof of attendance at La Crypta events. Linked to POA-HDMP system via NIP-58.
Given a talk or workshop. Verified by event organizers with badge issuance.
Built something for the community. Code, content, tools, or infrastructure.
Supported La Crypta via Lightning zaps. Verified through NIP-57 receipts.
Identity confirmed through NIP-05 DNS verification. The base of trust.
Long-term contributor with multiple badges. The real cypherpunk jungle animals.
Members of the community with different reputation levels. Spot the scammer.
Extend identity verification and reputation badges to Discord. Three modules ready to drop in — click any card to see the one-step integration.
Auto-verify users with Nostr identity. Commands to check profiles and badges in real-time.
Badge changes sync to Discord instantly. User gana badge → Bot updates roles automatically.
New members must verify their Nostr identity to access the server. Gatekeeping against scammers.
Identity infrastructure is only as trustworthy as its weakest endpoint. This project was pentested before submission — every CRITICAL and HIGH finding was closed.
| # | Attack | Result | Status |
|---|---|---|---|
| A1 | Register without Authorization | 401 | ✓ blocked |
| A2 | Identity hijack (auth pubkey ≠ body.pubkey) | 403 | ✓ blocked |
| A3 | Body tampering after signing | 401 | ✓ blocked |
| A4 | Replay (event older than 60s) | 401 | ✓ blocked |
| A5 | Claim reserved name (“admin”) | 403 | ✓ blocked |
| A6 | Oversized displayName (200 chars) | 400 | ✓ blocked |
| A7 | Form-encoded CSRF (simple request) | 415 | ✓ blocked |
| A8 | IP flood (12 rapid requests) | 429 | ✓ throttled |
| A9 | Name starts with “.” (regex bypass) | 400 | ✓ blocked |
| A10 | Malformed pubkey (not hex-64) | 400 | ✓ blocked |
Kind 27235 signed event required on POST /api/register. Server checks signature, URL match, method match, body hash, ±60s replay window, and that event.pubkey === body.pubkey.
Sliding window: 10 reqs / 10 min per IP and 3 registrations / hour per pubkey. Kills automated squatting.
24 protected handles: admin, root, lacrypta, satoshi, support, api… full list in SECURITY.md.
Strict regex on name, 64-char hex pubkey, displayName ≤ 64 chars, body ≤ 2 KB. Content-Type must be application/json.
CSP, HSTS (2y preload), X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy. Cache-Control: no-store on every API response.
nostr-tools pinned to exact 2.7.2 (no caret). ADMIN_KEY compared with crypto.timingSafeEqual. Planned: bundle crypto deps with Vite.
Connect your Nostr identity and start building reputation.
2-32 chars, lowercase. This becomes your verifiable handle.
Your NIP-05 will be served from /.well-known/nostr.json so any Nostr client can verify you.
Verified members of La Crypta with their reputation badges.
Loading verified members from Nostr relays...
Check if someone is really who they claim to be.