From 9342c967baf7f1f8ab3ab765b51eb9440df89d38 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 24 Sep 2025 16:31:50 -0400
Subject: [PATCH] Explain encrypt-to-self subscriptions

---
 js/subscriptions.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/js/subscriptions.js b/js/subscriptions.js
index db4fc9a4..4b80ebe6 100644
--- a/js/subscriptions.js
+++ b/js/subscriptions.js
@@ -125,6 +125,14 @@ class SubscriptionsManager {
     const plainObj = { subPubkeys: Array.from(this.subscribedPubkeys) };
     const plainStr = JSON.stringify(plainObj);
 
+    /*
+     * The subscription list is stored as a NIP-04 message to self, so both
+     * encryption and decryption intentionally use the user's own pubkey.
+     * Extensions are expected to support this encrypt-to-self flow; altering
+     * the target would break loadSubscriptions, which decrypts with the same
+     * pubkey. Any future sharing model (e.g., sharing with another user) will
+     * need a parallel read path and should not overwrite this behavior.
+     */
     let cipherText = "";
     try {
       cipherText = await window.nostr.nip04.encrypt(userPubkey, plainStr);