Help & Documentation

You can create a new repository or import from GitHub/GitLab/Codeberg. There are three ways to get started:

Go to Settings → Account to configure LNbits (send/receive keys), Lightning address (lud16 / lnurl receive), or NWC. Repository-specific overrides live under each repo's Settings → Payment configuration.

• Open gittr in your browser (HTTPS required).
• Click the install icon in the address bar, or go to the menu → Install app.
• Confirm to add gittr to your desktop/app launcher.

• Open gittr in Safari.
• Tap Share → Add to Home Screen.

• Open gittr in Chrome or Brave.
• Tap the menu → Install app.

Other Nostr app stores look for a GitHub Release with an .apk. Tagging v* on arbadacarbaYK/gittr builds a thin app (space.gittr.app) that opens gittr.space — same site as this PWA, not an offline self-hosted copy. Sign in with Amber / a remote signer; browser extensions are not inside the APK. After the Release exists, announce that tag from this repo’s Releases tab or Code sidebar Nostr Apps (NIP-82). Use app id space.gittr.app (the Android package — not space.gittr.gittr). zapstore.yaml in the git repo is what Zapstore uses to whitelist the publisher (icon + images: screenshots under ui/public/zapstore/, 1080×1920, gallery order: repo Code, Apps, Pages, Repos list, Appearance). Other apps put the same images: field in their source-repo zapstore.yaml (repo paths or https links); gittr copies those onto the Nostr listing when you Publish on Nostr.

Already on this APK? Open the user menu (your avatar, or the phone hamburger if you are signed out) and tap Update app. gittr checks GitHub for a newer installer and opens the download in your system browser. The Apps page card for space.gittr.app uses that same GitHub latest so it does not lag Zapstore. Pages inside the app already match the live website; you only need a new APK when the wrapper itself was rebuilt.

You can create repositories in three ways:

• Import from GitHub/GitLab/Codeberg: Files are automatically fetched and stored in your browser
• Create empty repository: Creates an empty repo that you must populate via Git CLI (clone, add files, commit, push)
• MCP or gn: Agents use createRepo (HTTPS + nsec, no SSH). Operators can use gn repo create. Same git host as the website.

All repos are stored locally in your browser and can be pushed to Nostr for public access. Tip: After Create empty, use Upload (files or folders, drag & drop) or push via Git — then Push to Nostr for public access.

• Local - Only exists on your device
• Pushing... - Currently being published to Nostr
• Live on Nostr - Published and visible to others
• Live (Unpushed Edits) - Has local changes not yet published
• Push Failed - Publication attempt failed

• Watch — publishes your NIP-51 kind 10018 followed-repos list (one replaceable event with the full a tag set each time).
• Star — NIP-25 kind 7 reaction on the repo's kind 30617 event. gittr looks that event up on your relays and on the same profile-repos query used to load files, Public/Private, Refetch, and new issues — a foreign GRASP clone still counts as published. The button stays Star while that lookup runs in the background (it should not flicker to “Looking up…”). A GitHub source that was deleted or made private is skipped — it must not stall the page. Also listed on your Stars page. Not the same as Watch.
• Zaps — shortcut to tip; totals combine Nostr zap receipts and this device's ledger where relevant.

Repo Settings → Repository Links adds documentation, Discord, Slack, YouTube, Twitter, GitHub, or other URLs. They show on the repository page below contributors — a YouTube video or a social post is a valid docs link, not only a README.

Owners use Delete Repository on the repo Settings page. You must sign. gittr publishes a Nostr deletion marker so other clients see it gone, hides it locally, and best-effort removes related Pages and app announces. This cannot be undone.

View, edit, and delete files or folders directly in the browser (owners: trash icon on each Code tree row, or Delete while a file is open). Deleting a folder marks it and everything inside for removal — the next Push to Nostr deletes it on the git host (GRASP / bridge), not just in this browser. Use the fuzzy file finder (Cmd/Ctrl+P) to quickly navigate large repositories.

Files live on git hosts (GRASP / gitnostr bridge), not inside Nostr events. NIP-34 announcements carry metadata and clone[] URLs. The Code sidebar shows where the tree is loading from: bridge / GRASP, GitHub, GitLab, and so on. Legacy “embedded in the event” trees are rare.

Bring an existing remote into gittr, then Push to Nostr so others can discover and clone it from GRASP / the bridge (not only from the original host). Details: When your git host goes dark.

• GitHub — single repo or bulk import. Linking GitHub via NIP-39 under Settings → Profile matches GitHub usernames to npubs (contributor pictures). It is not what makes you the gittr owner: importing while logged in already does that. The purple owner pill on a profile is “this npub announced the repo,” not “GitHub confirmed.” A profile’s repository grid is that npub’s Nostr announcements (including Shakespeare/ngit), the same list whether you are logged in or not — not GitHub and not the few repos your browser already cached. Importing your own GitHub repo is still owner. The purple forked pill is only for a real upstream parent (someone else’s repo on any supported forge) or a gittr Fork — not “this has a forge URL.”
• GitLab, Codeberg, Gitea / Forgejo, other HTTPS / git@ URLs — paste the full clone URL on Create repository (Option 1). The server runs a normal public git clone. Bulk import is GitHub-only. Forgejo/Gitea (including Codeberg and self-hosted) uses the same paste-URL import; Issues, PRs, and Releases then refresh from /api/v1. Nostr Pages and app announce work the same as for GitHub once a Release exists on that forge.
• Nostr-only / GRASP — paste npub…/repo, a gittr.space repo page, or a git.gittr.space clone URL on Option 1. The Fork button on a repo page uses the same import (parent files, not an empty About stub).

gittr.space repositories support multiple clone URL formats:

SSH, HTTPS, and nostr:// clone URLs all ship inside every NIP-34 repository event. Pick whichever matches your workflow.

NIP-34 events carry metadata (name, description,clone[] URLs) — not the full file tree. gittr loads the tree from git servers and our bridge mirror.

1. Cache / small embedded files in the event (legacy)
2. GitHub / GitLab / Codeberg when a source or GitHub clone URL exists
3. For each GRASP HTTPS URL in clone[] (in parallel): read our on-disk mirror, or shallow-clone that URL directly, or mirror it onto gittr then read

If one mirror is down (502) but another works (e.g. relay.ngit.dev), you still get files from the working URL. The status chip on the repo shows ✓/✗ per source.

SSH / CLI vs Code tab: git clone [email protected]:… reads the same bridge bare repo the Code tab uses. The website additionally walks published clone[] /source URLs (forge first, then GRASP mirrors). File timestamps on the Code list come from the selected tip/branch on that mirror. Nostr Backups should list every pushable GRASP host from the event (not only git.gittr.space). After a clean Push with a forge source, the tip should match the forge — not a new empty “Push from gittr” commit. Details: FILE_FETCHING_INSIGHTS.md.

Newest metadata: we use the latest kind 30617 from relays. Newest commit across all mirrors: we currently show the first mirror that responds with a tree, not a full compare of every server's HEAD — see FILE_FETCHING_INSIGHTS.md.

After making local changes, click Push to Nostr on the Code tab (sidebar). Result and cache-flush messages open in a gittr dialog that grows to fit the full text (not the browser's tiny alert box). Sign with NIP-07, Amber / NIP-46 remote signer, or nsec — same login as Settings. Or use gittr-mcp publishRepoAnnouncement / createRepo (same events, local nsec, no SSH).

Amber must stay open/unlocked on your phone. Push first opens sockets to Amber's bunker relays; if that fails, nothing is published. Hard-refresh once if a previous page load left those relays stuck, then try Push again.

That does two different things — and it does not create a forge Release, upload installers, or list the app on /apps. Those are separate, on-purpose steps (Releases, Pages & Apps):

• Announce — we sign a NIP‑34 event (name, description, clone links, etc.) and publish it to your relays. The event is mostly metadata, not your full Git history.
• Mirror (gittr) — we also try to put a Git copy on git.gittr.space so people can clone from here. That usually works after Push, but it is not guaranteed if the mirror step fails.

Imported repos: Push does not move your project off GitHub/GitLab/Codeberg. The forge stays the original (source). gittr lists its bridge/GRASP URLs for Nostr clients and tries to mirror objects onto the bridge. Other GRASP hosts (e.g. relay.ngit.dev) may also appear in clone links if configured — those are extra mirrors/links, not “everything lives only on gittr.”

If you see "Please repush on local edits", use Push to Nostr so relays (and the mirror attempt) get those edits. Import alone stays local until you Push. For repos that already live on the gittr bridge but not in this browser, Refresh from gittr (or just Upload — it will prepare a local copy) before Push.

Rough week for some self-hosted Git setups — here's the practical bit, no panic.

A normal git clone or gittr import only copies repo objects (commits, trees, blobs). It does not bring over Gitea's app.ini, internal token, or planted service hooks. Those stay on the compromised or shut-down host. So code you already imported into gittr is not carrying that server compromise with it.

What keeps the repo visible and cloneable online is an independent mirror: import (or clone) into gittr, then Push to Nostr. That publishes the announcement on relays and puts objects on GRASP / the bridge (git.gittr.space and other clone[] hosts). Others can keep discovering and cloning without the original forge.

Quick check: can someone still git clone from a URL in your announcement clone[] without the original host? If yes, that snapshot is fine. If every clone URL still points only at the dead host, finish a Push (or push to a GRASP remote) so the tree has somewhere else to live.

SSH keys are only for laptop [email protected]. They are Nostr kind 52 events the bridge copies into authorized_keys. The website is not in the SSH path after the key is registered.

• Optional UI: Settings → SSH Keys → Add Key (paste form under the button). Kind 52 is signed with NIP-07, Amber / NIP-46 (bunker), or nsec — approve the prompt. In-browser generate is off; use ssh-keygenlocally.
• CLI, no UI: gn ssh-key add ~/.ssh/id_ed25519.pub
• Agents: gittr-mcp uses HTTPS + nsec instead — skip SSH entirely

Push to Nostr, issues, and PRs in the browser use your Nostr key, not SSH.

Share code snippets from your repositories as standalone, discoverable events on Nostr.

Reference code snippets in issue and PR comments. Snippets will appear inline with syntax highlighting.

• Syntax Highlighting: Code is displayed with proper formatting
• Copy Code: One-click copy button
• Download: Download snippet as a file
• Repository Link: Click to view the source repository
• Discoverable: Snippets are searchable across the Nostr network

Zap a repository to tip the owner (and optionally split among contributors). Repo Settings → Zap Split Policy sets weights. The zap button’s Split (N) mode shares among those people. Owner only resolves where the invoice is paid to using the priority below. When the LNURL-pay endpoint supports NIP-57, gittr requests a real zap invoice. Split mode mints the invoice from your LNbits wallet (repo payment config first, then Settings → Account) plus the SplitPayments extension — it does not rely on Nostr zap receipts for routing.

Rows above describe what each flow needs, not every optional shortcut. Bounty creation always uses the bounty creator's keys from Settings → Account (not the repo's LNbits send configuration).

Anyone can fund issues with bounties to incentivize contributions. Put sats on a new feature, or leave a bounty sitting on an issue for someone who discloses a security problem — there is no separate “CVE queue”; it is a normal issue with a bounty. Bounties use LNURL-withdraw links created from the bounty creator's LNbits wallet. The funds are reserved in the creator's wallet and will be deducted when the PR author claims the withdraw link.

Visit the Bounty Hunt page to discover funded issues across all repositories.

Go to Settings → Notifications to set up:

• Nostr DMs - Receive encrypted direct messages on Nostr
• Telegram - Private DMs via @gittrupdatebot: send /start, paste the User ID into Settings → Notifications. No public channel post required. You can enable Nostr and Telegram together.

Save now does two things: publishes your toggles as a kind 30078 event (d=gittr/notifications) so prefs sync across browsers, and registers delivery on the server (Telegram User ID stays off public relays). DMs always use the recipient's saved prefs — not whoever clicked in their own browser.

Bounty announcements are also posted to the public @gittrspace channel (announcements only — not used for auth).

You can enable/disable notifications for:

• New issue in watched repos - When someone opens an issue in a repository you're watching
• Comments on issues I opened/participate - When someone comments on an issue you created or are assigned to
• New pull request in watched repos - When someone opens a PR in a repository you're watching
• Reviews requested or comments on my PRs - When someone requests your review or comments on your PR
• My PR merged - When your pull request is merged
• I am @mentioned - When someone mentions you in a comment or description
• My Bounties - When a bounty is funded on an issue you created (you'll be notified about the bounty amount)
• Bounty released to me - When a bounty withdraw link is released to you after a PR you created is merged

Defaults: collaboration (new issues, issue comments, PRs, reviews, merges, mentions, bounties) is on; stars / watches / zaps are off; security (CVE) alerts stay off until you opt in.

Dependency notices are listed under Dependency notices (CVE).

Important: Changes to notification preferences are not active until you click "SAVE NOW". Make sure to save your preferences after making changes.

Supply-chain attacks on git forges are a hot topic. gittr scans the dependencies of every repo against the public OSV.dev vulnerability database and shows the result on the repo's Dependencies tab.

Exact matches only: an advisory is only reported as confirmed when the exact dependency version from your committed lockfile (package-lock.json, yarn.lock, Cargo.lock, go.mod, pinned requirements.txt, …) falls inside the version range the advisory declares as affected. Versions guessed from ranges in package.json are listed separately as unconfirmed and never trigger alarms.

How the message looks: Telegram / Nostr DMs lead with the repo name, list at most a few findings, and link to that repo's Dependencies tab — not a public Issues entry. Advisory names stay in the private message. Wording is deliberately calm: this is a dependency advisory notice, not a claim that the project is compromised.

How often does the check run? The audit runs fresh every time the Dependencies tab of a repo is opened — there is no fixed schedule. It reads the lockfiles from the pushed repo tip on gittr (the bridge clone), not from files only on your laptop or only on GitHub until those are synced here. Advisory details are cached on the server for about 6 hours, so a newly published CVE shows up within hours, at the latest on the next visit after the cache expires.

How alerts reach you (Dependabot-style): when a published CRITICAL or HIGH advisory matches a direct pinned dependency on a repo that has code on gittr (created / imported / pushed here — not merely announced from another client), the platform can send a private notice on the same channels you enabled (Nostr and/or Telegram). GitHub Dependabot keeps vulnerability alerts off the public Issues tab; gittr does the same. Nostr issues are public on relays — there is no owner-only issue kind — so we never post CVE names there. A lockfile match still needs your check: whether your code actually uses the affected APIs. All notification toggles (including Security) live in one kind 30078 event (d=gittr/notifications) so they sync across browsers. Save also registers delivery on this server (Telegram User ID stays off public relays).

Your repos only — not watched / starred: Security scans the repos you own on gittr (your kind 30617 announcements), not projects you only watch, star, or follow. Watching someone else's stack is intentionally out of scope — noisy, permission-awkward, and easy to get wrong. If you want CVE / early-warning coverage of another project, fork or import it under your account so you own the tip on gittr, then keep Push in sync as usual.

Fresh tip only — keep announcement in line with source: the scanner reads lockfiles from the gittr bridge clone, but only when Nostr repo state (kind 30618) exactly matches that clone. No tip, or tip ≠ bridge → skip (no DM about the wrong tree). That match is what a successful Push from the gittr UI is supposed to publish. If you changed the repo on GitHub (or another forge) and want CVE coverage of that tip: bring it onto gittr (sync / refetch from source on the repo), then Push so the announcement lines up with the mirror. A browser-only file refresh without Push does not update the announcement. Same idea if you only update in another Nostr git client — Push/sync on gittr again when you want alerts here.

How notices are sent: when you are opted in, the platform bot DMs you (Nostr and/or Telegram per your prefs) for each new CRITICAL/HIGH lockfile match. It does not open a public issue. The same advisory is not re-sent on later scans.

Early (pre-CVE) warnings — same opt-in: with Security enabled you also get private DMs when the public Vulnerability Spoiler Alert RSS flags a HIGH/CRITICAL finding that looks related to a direct dependency in that repo (often before a CVE exists). There is no extra checkbox. These tips are not shown on the Dependencies tab (that tab stays OSV/confirmed only), and we do not open a gittr Issues entry for them. If the Spoiler feed is unreachable, Dependencies + normal dependency notices keep working unchanged.

One alert per problem — not per scan: each advisory triggers at most one issue per package per repo. Repeated scans that find the same known vulnerability stay silent.

Get the most protection:

• Commit your lockfiles. Without them, exact versions can't be verified and you only get unconfirmed hints.
• Pin versions where your ecosystem supports it (e.g. package==1.2.3 in requirements.txt).
• Opt in and Save in Settings → Notifications so consent is on relays — localStorage alone is not enough for the bot.
• Keep Push / announcement current. After dependency or tip changes on GitHub (or on gittr), sync from source if needed, then Push so kind 30618 matches the tip on gittr — otherwise CVE alerts stay skipped.
• Check the Dependencies tab after importing a repo and after dependency updates are on gittr.
• Update affected packages to a version outside the advisory's affected range, then get that new lockfile onto gittr before re-checking the tab: Nostr/git push if you fixed it locally, or sync from the source forge + Push if you fixed it there. Opening the tab alone does not see unpushed or unsynced changes.

When you are logged in, gittr shows a small hop badge next to other people's names on profiles, repo owners, /apps, and /pages. It is relative to you — how many follow-hops away they are — not a global score. Labels: In your network, N hops from you, Outside your network when the oracle finds no path, or Distance unknown when the lookup is down or the WoT extension has no distance (a mute or an incomplete graph). Logged out, the hop badge is hidden. Your own profile does not show hops to yourself.

Direct follows come from your kind-3 contact list. Multi-hop distance can use a browser WoT extension or the public oracle. Linked external identities are a separate signal: they help you decide whether the npub is the same person as a GitHub or X account.

Under Settings → Profile, claim GitHub, X, Telegram, Mastodon, and other accounts so others can see you are the same person on Nostr. Claims publish as NIP-39 kind 10011. Optional proof (GitHub Gist, tweet). The chips also help when someone is judging Web of Trust, and imports can match GitHub contributors to Nostr profiles. NIP-05 (name@domain) is a separate checkmark on kind 0 — name, bio, and avatar stay on that event.

Tip: if you connected GitHub on Settings → SSH Keys, it can appear under Verified Identities automatically — then save Profile to publish the claim.

Open Lab in the header for a snapshot map of ecosystem dependencies around gittr (gittr is the seed repo), and which repos that use those dependencies look affected. Display-only — not a live hunt. Run local-agent yourself if you want to hunt on your own machine.

Per-repo lockfile CVEs stay on each repo's Dependencies tab, with optional private DMs — that is a different surface from Lab. See Dependency notices (CVE).

Bounty notifications are sent to:

• Issue Owner (My Bounties): When someone funds a bounty on your issue, you'll receive a notification via Nostr DM and/or Telegram (if enabled) with the bounty amount and issue details.
• PR Author (Bounty released to me): When a PR you created is merged and linked to an issue with a bounty, you'll receive a notification that the bounty withdraw link has been released to you. The notification includes the bounty amount and instructions on how to claim it.
• Bounty Creator (Bounty cancelled): When an issue with your bounty is closed without a PR, you'll receive a notification that the bounty was cancelled and the withdraw link was deleted. This helps you know that your funds are no longer reserved.

Bounty announcements are also automatically posted to the public @gittrspace Telegram channel, regardless of your notification preferences.

Think of three separate layers. Mixing them up is what causes confusion — not the UI itself.

If the forge later goes offline, mirrored source code (after Push) can still be cloned from GRASP — but release installers that only lived on the forge will not. Full table: When your git host goes dark.

Owners publish a static site from the repo Code sidebar → Nostr Pages. Required: a root index.html, then Push Manifest (uploads to Blossom and publishes kind 35128). That is what puts the page online — it is not a git push and not an issue. Optional: a custom site name (1–13 characters in the live URL; longer names like conference-loop become conference-lo) and a README pagelink for repo visitors. If you changed files or the README, Push to Nostr first, then Push Manifest. Browse live sites at /pages.

gittr's gateway is adapted from hzrd146's nsite work — credit where it's due:

• Upstream: hzrd146 / nsite-gateway
• gittr fork / deploy: gittr / nsite-gateway
• Blob storage: gittr-blossom at blossom.gittr.space

Owners list an app from the Code sidebar → Nostr Apps (latest forge Release tag) or from the Releases tab on a chosen tag. Both use the same form (screenshots, pin, publish). A Nostr version like 1.0.0 matches GitHub v1.0.0. Link a GitHub / Codeberg / GitLab source URL. The chosen Release must include an announceable binary (an .apk is preferred for Zapstore Android). Verify the file, then Publish on Nostr (NIP-82). Zapstore needs the APK; other binaries on the same Release tag (DMG, AppImage, MSI/EXE, …) can be linked as extra NIP-82 assets on that version. Files stay on the forge by default; gittr only announces. An optional checkbox pins a copy onto public Blossom hosts (Primal, Ditto, Haven) — never blossom.gittr.space except gittr’s own Android APK (space.gittr.app), which also publishes the dark-plate bird as the app icon, phone screenshots, and the product about. Other apps copy their public repo logo when one exists, and copy images: from their source-repo zapstore.yaml as listing screenshots (optional extra https URLs in the announce panel). gittr’s own listing has no extra-URL box — those shots always come from ui/public/zapstore/. The repo Releases tab lists all forge download assets (not only APKs). The Code-tab About → Links sidebar shows the app name (same as /apps) for everyone — from the last Push, or hydrated from the app catalog if this browser never announced. Duplicate App rows for the same package id are collapsed. Listed on /apps is unique publisher + package id (not every new card you notice) — a republish of the same id updates the listing without adding 1. After Zapstore paging, Listed can sit around three thousand because Zapstore’s indexer lists a large mobile catalog underone publisher (still unique publisher + id). That is the same Nostr app list gittr already counts — Zapstore’s relay is just where most kind 32267 events live, not a second counter added on top. Owner Remove listing is NIP-09 and hides that author’s card; it does not shrink Zapstore’s catalog. Zapstore only answers 50 app events per request, so Listed keeps climbing for a short while as gittr walks older pages. The hub keeps a running snapshot so those apps are not dropped on the next refresh. Announcing does not put the APK into the git file tree. How Releases, forge files, and announces fit together: Releases & where they live. Discover apps at /apps. Each card's Repo button is the source tree so you can verify the code (gittr Code when the announce has a NIP-34 pointer, otherwise Zapstore's repository URL — that tag is meant to be git clone-able). Releases is the forge download page. Signed-in owners: user menu Your Apps to remove a leftover listing (one app id) without deleting the git repo or the APK file. The Code-tab app name link stays so the next Push still publishes it — leftover GITTR is not kept next to space.gittr.app.

Optional Zapstore catalog: add zapstore.yaml at the source repo root (pubkey, repository, plus images: screenshot paths or https links), then publish again. Details:

• Zapstore on gittr: zapstore
• Publish docs: zapstore.dev/docs/publish

Create PRs to propose changes. Reviewers can approve, request changes, or merge PRs. Repo owners editing their own Nostr / bridge repos on the Code tab can Save changes locally and use Push to Nostr — they do not need a PR.

Each repo has a ToDo tab (Projects) with Kanban and Roadmap views. If the git source is GitHub/GitLab/Codeberg, gittr shows that forge’s board read-only — it does not write cards back, and it does not keep a second this-browser board in that view (that is why notes seemed to vanish after a restart). Nostr-only repos keep the board in this browser until a kanban NIP exists; drag cards to update status. Milestones live in repo Settings and on issues/PRs. Open /projects for the aggregated board.

Forge-backed repos show GitHub Discussions only, read-only — gittr never posts back. Nostr-only repos publish NIP-23 threads to relays and keep a cache in this browser. After a restart the cache is still there; if the live relay copy differs, use Nostr vs This browser to pick which version to read.

Track bugs, feature requests, and discussions. Add bounties to incentivize solutions — a new feature, or an issue sitting open for someone who discloses a security problem.

Link your GitHub profile in Settings to show your profile picture as a contributor icon.

All your data (repos, keys, settings) is stored locally in your browser. It never leaves your device unless you explicitly push to Nostr.

Settings → Security shows how you actually sign in. Amber / NIP-46 and NIP-07 keep your identity key off this site — you do not need encryption for login. Encryption is for an nsec stored in this browser, and for Lightning / NWC secrets on Settings → Account if you saved any.

Repositories default to public when pushed to Nostr. You can set them to private in repository settings.

• gittr.space (live)
• gittr source repo
• Notification Settings
• Profile & Verified Identities

If you have questions or hit issues, see the gittr source repo, plus gitnostr and gittr-helper-tools, gittr-blossom, and the Nostr schemata reference for NIPs and kinds.