Help & Documentation

You can create a new repository or import from GitHub/GitLab/Codeberg. There are three ways to get started:

Go to Settings → Account to configure LNbits (send/receive keys), Lightning address (lud16 / lnurl receive), or NWC. Repository-specific overrides live under each repo's Settings → Payment configuration.

• Open gittr in your browser (HTTPS required).
• Click the install icon in the address bar, or go to the menu → Install app.
• Confirm to add gittr to your desktop/app launcher.

• Open gittr in Safari.
• Tap Share → Add to Home Screen.

• Open gittr in Chrome or Brave.
• Tap the menu → Install app.

You can create repositories in three ways:

• Import from GitHub/GitLab/Codeberg: Files are automatically fetched and stored in your browser
• Create empty repository: Creates an empty repo that you must populate via Git CLI (clone, add files, commit, push)
• MCP or gn: Agents use createRepo (HTTPS + nsec, no SSH). Operators can use gn repo create. Same git host as the website.

All repos are stored locally in your browser and can be pushed to Nostr for public access. Tip: After Create empty, use Upload (files or folders, drag & drop) or push via Git — then Push to Nostr for public access.

• Local - Only exists on your device
• Pushing... - Currently being published to Nostr
• Live on Nostr - Published and visible to others
• Live (Unpushed Edits) - Has local changes not yet published
• Push Failed - Publication attempt failed

• Watch — publishes your NIP-51 kind 10018 followed-repos list (one replaceable event with the full a tag set each time).
• Star — NIP-25 kind 7 reaction on the repo's kind 30617 event. gittr looks that event up on your relays and on the same profile-repos query used to load files, Public/Private, Refetch, and new issues — a foreign GRASP clone still counts as published. The button stays Star while that lookup runs in the background (it should not flicker to “Looking up…”). A GitHub source that was deleted or made private is skipped — it must not stall the page. Also listed on your Stars page. Not the same as Watch.
• Zaps — shortcut to tip; totals combine Nostr zap receipts and this device's ledger where relevant.

View, edit, and delete files or folders directly in the browser (owners: trash icon on each Code tree row, or Delete while a file is open). Deleting a folder marks it and everything inside for removal — the next Push to Nostr deletes it on the git host (GRASP / bridge), not just in this browser. Use the fuzzy file finder (Cmd/Ctrl+P) to quickly navigate large repositories.

Files live on git hosts (GRASP / gitnostr bridge), not inside Nostr events. NIP-34 announcements carry metadata and clone[] URLs. The Code sidebar shows where the tree is loading from: bridge / GRASP, GitHub, GitLab, and so on. Legacy “embedded in the event” trees are rare.

Bring an existing remote into gittr, then Push to Nostr so others can discover and clone it from GRASP / the bridge (not only from the original host). Details: When your git host goes dark.

• GitHub — single repo or bulk import. Linking GitHub via NIP-39 under Settings → Profile matches GitHub usernames to npubs (contributor pictures). It is not what makes you the gittr owner: importing while logged in already does that. The purple owner pill on a profile is “this npub announced the repo,” not “GitHub confirmed.” A profile’s repository grid is that npub’s Nostr announcements (including Shakespeare/ngit), the same list whether you are logged in or not — not GitHub and not the few repos your browser already cached. Importing your own GitHub repo is still owner. The purple forked pill is only for a real upstream parent (someone else’s repo on any supported forge) or a gittr Fork — not “this has a forge URL.”
• GitLab, Codeberg, Gitea / Forgejo, other HTTPS / git@ URLs — paste the full clone URL on Create repository (Option 1). The server runs a normal public git clone. Bulk import is GitHub-only. Forgejo/Gitea (including Codeberg and self-hosted) uses the same paste-URL import; Issues, PRs, and Releases then refresh from /api/v1. Nostr Pages and app announce work the same as for GitHub once a Release exists on that forge.
• Nostr-only / GRASP — paste npub…/repo, a gittr.space repo page, or a git.gittr.space clone URL on Option 1. The Fork button on a repo page uses the same import (parent files, not an empty About stub).

gittr.space repositories support multiple clone URL formats:

SSH, HTTPS, and nostr:// clone URLs all ship inside every NIP-34 repository event. Pick whichever matches your workflow.

NIP-34 events carry metadata (name, description,clone[] URLs) — not the full file tree. gittr loads the tree from git servers and our bridge mirror.

1. Cache / small embedded files in the event (legacy)
2. GitHub / GitLab / Codeberg when a source or GitHub clone URL exists
3. For each GRASP HTTPS URL in clone[] (in parallel): read our on-disk mirror, or shallow-clone that URL directly, or mirror it onto gittr then read

If one mirror is down (502) but another works (e.g. relay.ngit.dev), you still get files from the working URL. The status chip on the repo shows ✓/✗ per source.

SSH / CLI vs Code tab: git clone [email protected]:… reads the same bridge bare repo the Code tab uses. The website additionally walks published clone[] /source URLs (forge first, then GRASP mirrors). File timestamps on the Code list come from the selected tip/branch on that mirror. Clone URL chips should list every pushable GRASP host from the event (not only git.gittr.space). After a clean Push with a forge source, the tip should match the forge — not a new empty “Push from gittr” commit. Details: FILE_FETCHING_INSIGHTS.md.

Newest metadata: we use the latest kind 30617 from relays. Newest commit across all mirrors: we currently show the first mirror that responds with a tree, not a full compare of every server's HEAD — see FILE_FETCHING_INSIGHTS.md.

After making local changes, click Push to Nostr on the Code tab (sidebar). Result and cache-flush messages open in a gittr dialog that grows to fit the full text (not the browser's tiny alert box). Sign with NIP-07, Amber / NIP-46 remote signer, or nsec — same login as Settings. Or use gittr-mcp publishRepoAnnouncement / createRepo (same events, local nsec, no SSH).

Amber must stay open/unlocked on your phone. Push first opens sockets to Amber's bunker relays; if that fails, nothing is published. Hard-refresh once if a previous page load left those relays stuck, then try Push again.

That does two different things — and it does not create a forge Release, upload installers, or list the app on /apps. Those are separate, on-purpose steps (Releases, Pages & Apps):

• Announce — we sign a NIP‑34 event (name, description, clone links, etc.) and publish it to your relays. The event is mostly metadata, not your full Git history.
• Mirror (gittr) — we also try to put a Git copy on git.gittr.space so people can clone from here. That usually works after Push, but it is not guaranteed if the mirror step fails.

Imported repos: Push does not move your project off GitHub/GitLab/Codeberg. The forge stays the original (source). gittr lists its bridge/GRASP URLs for Nostr clients and tries to mirror objects onto the bridge. Other GRASP hosts (e.g. relay.ngit.dev) may also appear in clone links if configured — those are extra mirrors/links, not “everything lives only on gittr.”

If you see "Please repush on local edits", use Push to Nostr so relays (and the mirror attempt) get those edits. Import alone stays local until you Push. For repos that already live on the gittr bridge but not in this browser, Refresh from gittr (or just Upload — it will prepare a local copy) before Push.

Rough week for some self-hosted Git setups — here's the practical bit, no panic.

A normal git clone or gittr import only copies repo objects (commits, trees, blobs). It does not bring over Gitea's app.ini, internal token, or planted service hooks. Those stay on the compromised or shut-down host. So code you already imported into gittr is not carrying that server compromise with it.

What keeps the repo visible and cloneable online is an independent mirror: import (or clone) into gittr, then Push to Nostr. That publishes the announcement on relays and puts objects on GRASP / the bridge (git.gittr.space and other clone[] hosts). Others can keep discovering and cloning without the original forge.

Quick check: can someone still git clone from a URL in your announcement clone[] without the original host? If yes, that snapshot is fine. If every clone URL still points only at the dead host, finish a Push (or push to a GRASP remote) so the tree has somewhere else to live.

SSH keys are only for laptop [email protected]. They are Nostr kind 52 events the bridge copies into authorized_keys. The website is not in the SSH path after the key is registered.

• Optional UI: Settings → SSH Keys. Kind 52 is signed with NIP-07, Amber / NIP-46 (bunker), or nsec — not only a browser extension.
• CLI, no UI: gn ssh-key add ~/.ssh/id_ed25519.pub
• Agents: gittr-mcp uses HTTPS + nsec instead — skip SSH entirely

Push to Nostr, issues, and PRs in the browser use your Nostr key, not SSH.

Share code snippets from your repositories as standalone, discoverable events on Nostr.

Reference code snippets in issue and PR comments. Snippets will appear inline with syntax highlighting.

• Syntax Highlighting: Code is displayed with proper formatting
• Copy Code: One-click copy button
• Download: Download snippet as a file
• Repository Link: Click to view the source repository
• Discoverable: Snippets are searchable across the Nostr network

Zap a repository to tip the owner (and optionally split among contributors). Owner only resolves where the invoice is paid to using the priority below. When the LNURL-pay endpoint supports NIP-57, gittr requests a real zap invoice. Split mode mints the invoice from your LNbits wallet (repo payment config first, then Settings → Account) plus the SplitPayments extension — it does not rely on Nostr zap receipts for routing.

Rows above describe what each flow needs, not every optional shortcut. Bounty creation always uses the bounty creator's keys from Settings → Account (not the repo's LNbits send configuration).

Anyone can fund issues with bounties to incentivize contributions. Bounties use LNURL-withdraw links created from the bounty creator's LNbits wallet. The funds are reserved in the creator's wallet and will be deducted when the PR author claims the withdraw link.

Visit the Bounty Hunt page to discover funded issues across all repositories.

Go to Settings → Notifications to set up:

• Nostr DMs - Receive encrypted direct messages on Nostr
• Telegram - Private DMs via @gittrupdatebot: send /start, paste the User ID into Settings → Notifications. No public channel post required. You can enable Nostr and Telegram together.

Save now does two things: publishes your toggles as a kind 30078 event (d=gittr/notifications) so prefs sync across browsers, and registers delivery on the server (Telegram User ID stays off public relays). DMs always use the recipient's saved prefs — not whoever clicked in their own browser.

Bounty announcements are also posted to the public @gittrspace channel (announcements only — not used for auth).

You can enable/disable notifications for:

• New issue in watched repos - When someone opens an issue in a repository you're watching
• Comments on issues I opened/participate - When someone comments on an issue you created or are assigned to
• New pull request in watched repos - When someone opens a PR in a repository you're watching
• Reviews requested or comments on my PRs - When someone requests your review or comments on your PR
• My PR merged - When your pull request is merged
• I am @mentioned - When someone mentions you in a comment or description
• My Bounties - When a bounty is funded on an issue you created (you'll be notified about the bounty amount)
• Bounty released to me - When a bounty withdraw link is released to you after a PR you created is merged

Defaults: collaboration (new issues, issue comments, PRs, reviews, merges, mentions, bounties) is on; stars / watches / zaps are off; security (CVE) alerts stay off until you opt in.

Dependency notices are listed under Dependency notices (CVE).

Important: Changes to notification preferences are not active until you click "SAVE NOW". Make sure to save your preferences after making changes.

Supply-chain attacks on git forges are a hot topic. gittr scans the dependencies of every repo against the public OSV.dev vulnerability database and shows the result on the repo's Dependencies tab.

Exact matches only: an advisory is only reported as confirmed when the exact dependency version from your committed lockfile (package-lock.json, yarn.lock, Cargo.lock, go.mod, pinned requirements.txt, …) falls inside the version range the advisory declares as affected. Versions guessed from ranges in package.json are listed separately as unconfirmed and never trigger alarms.

How the message looks: Telegram / Nostr DMs lead with the repo name, list at most a few findings, and link to a tracking Issues entry on that repo — not a wall of hex URLs or truncated advisory dumps. Wording is deliberately calm: this is a dependency advisory notice, not a claim that the project is compromised.

How often does the check run? The audit runs fresh every time the Dependencies tab of a repo is opened — there is no fixed schedule. It reads the lockfiles from the pushed repo tip on gittr (the bridge clone), not from files only on your laptop or only on GitHub until those are synced here. Advisory details are cached on the server for about 6 hours, so a newly published CVE shows up within hours, at the latest on the next visit after the cache expires.

How alerts reach you (Dependabot-style): when a published CRITICAL or HIGH advisory matches a direct pinned dependency on a repo that has code on gittr (created / imported / pushed here — not merely announced from another client), the platform can open a normal Issues entry on that repo (for tracking) and notify you on the same channels you enabled (Nostr and/or Telegram). That entry is visible on the repo's Issues tab like any other issue — we avoid frightening “security incident” branding. A lockfile match still needs your check: whether your code actually uses the affected APIs. All notification toggles (including Security) live in one kind 30078 event (d=gittr/notifications) so they sync across browsers. Save also registers delivery on this server (Telegram User ID stays off public relays).

Your repos only — not watched / starred: Security scans the repos you own on gittr (your kind 30617 announcements), not projects you only watch, star, or follow. Watching someone else's stack is intentionally out of scope — noisy, permission-awkward, and easy to get wrong. If you want CVE / early-warning coverage of another project, fork or import it under your account so you own the tip on gittr, then keep Push in sync as usual.

Fresh tip only — keep announcement in line with source: the scanner reads lockfiles from the gittr bridge clone, but only when Nostr repo state (kind 30618) exactly matches that clone. No tip, or tip ≠ bridge → skip (no DM about the wrong tree). That match is what a successful Push from the gittr UI is supposed to publish. If you changed the repo on GitHub (or another forge) and want CVE coverage of that tip: bring it onto gittr (sync / refetch from source on the repo), then Push so the announcement lines up with the mirror. A browser-only file refresh without Push does not update the announcement. Same idea if you only update in another Nostr git client — Push/sync on gittr again when you want alerts here.

How notices are sent: when you are opted in, the platform bot opens a calm dependency-tracking Issues entry on that repo and DMs you (Nostr and/or Telegram per your prefs) for each new CRITICAL/HIGH lockfile match. The same advisory is not re-sent on later scans.

Early (pre-CVE) warnings — same opt-in: with Security enabled you also get private DMs when the public Vulnerability Spoiler Alert RSS flags a HIGH/CRITICAL finding that looks related to a direct dependency in that repo (often before a CVE exists). There is no extra checkbox. These tips are not shown on the Dependencies tab (that tab stays OSV/confirmed only), and we do not open a gittr Issues entry for them. If the Spoiler feed is unreachable, Dependencies + normal dependency notices keep working unchanged.

One alert per problem — not per scan: each advisory triggers at most one issue per package per repo. Repeated scans that find the same known vulnerability stay silent.

Get the most protection:

• Commit your lockfiles. Without them, exact versions can't be verified and you only get unconfirmed hints.
• Pin versions where your ecosystem supports it (e.g. package==1.2.3 in requirements.txt).
• Opt in and Save in Settings → Notifications so consent is on relays — localStorage alone is not enough for the bot.
• Keep Push / announcement current. After dependency or tip changes on GitHub (or on gittr), sync from source if needed, then Push so kind 30618 matches the tip on gittr — otherwise CVE alerts stay skipped.
• Check the Dependencies tab after importing a repo and after dependency updates are on gittr.
• Update affected packages to a version outside the advisory's affected range, then get that new lockfile onto gittr before re-checking the tab: Nostr/git push if you fixed it locally, or sync from the source forge + Push if you fixed it there. Opening the tab alone does not see unpushed or unsynced changes.

Bounty notifications are sent to:

• Issue Owner (My Bounties): When someone funds a bounty on your issue, you'll receive a notification via Nostr DM and/or Telegram (if enabled) with the bounty amount and issue details.
• PR Author (Bounty released to me): When a PR you created is merged and linked to an issue with a bounty, you'll receive a notification that the bounty withdraw link has been released to you. The notification includes the bounty amount and instructions on how to claim it.
• Bounty Creator (Bounty cancelled): When an issue with your bounty is closed without a PR, you'll receive a notification that the bounty was cancelled and the withdraw link was deleted. This helps you know that your funds are no longer reserved.

Bounty announcements are also automatically posted to the public @gittrspace Telegram channel, regardless of your notification preferences.

Think of three separate layers. Mixing them up is what causes confusion — not the UI itself.

If the forge later goes offline, mirrored source code (after Push) can still be cloned from GRASP — but release installers that only lived on the forge will not. Full table: When your git host goes dark.

Owners publish a static site from the repo Code sidebar → Nostr Pages: add a root entry file (for example index.html), keep the README Pages block in sync, Push to Nostr, then Push Manifest (uploads to Blossom and publishes kind 35128). Browse live sites at /pages.

gittr's gateway is adapted from hzrd146's nsite work — credit where it's due:

• Upstream: hzrd146 / nsite-gateway
• gittr fork / deploy: gittr / nsite-gateway

Owners list an Android app from the Code sidebar → Nostr Apps: link a GitHub / Codeberg / GitLab source URL, pick a Release that includes an .apk, verify the APK, then Publish on Nostr (NIP-82). Zapstore needs the APK; other binaries on the same Release tag (DMG, AppImage, MSI/EXE, …) can be linked as extra NIP-82 assets on that version. Files stay on the forge; gittr only announces. The repo Releases tab lists all forge download assets (not only APKs). How Releases, forge files, and announces fit together: Releases & where they live. Discover apps at /apps.

Optional Zapstore catalog: add zapstore.yaml at the source repo root, then publish again. Details:

• Zapstore on gittr: zapstore
• Publish docs: zapstore.dev/docs/publish

Create PRs to propose changes. Reviewers can approve, request changes, or merge PRs. Repo owners editing their own Nostr / bridge repos on the Code tab can Save changes locally and use Push to Nostr — they do not need a PR.

Track bugs, feature requests, and discussions. Add bounties to incentivize solutions.

Link your GitHub profile in Settings to show your profile picture as a contributor icon.

All your data (repos, keys, settings) is stored locally in your browser. It never leaves your device unless you explicitly push to Nostr.

Your Nostr private key and payment credentials are encrypted with a password you set. Enable encryption in Settings → Security.

Repositories default to public when pushed to Nostr. You can set them to private in repository settings.

• gittr.space (live)
• gittr source repo
• Notification Settings
• Profile & Verified Identities

If you have questions or hit issues, see the gittr source repo, plus gitnostr and gittr-helper-tools, and the Nostr schemata reference for NIPs and kinds.