I don't think there was ever a vulnerability in a Bitcoin wallet that allowed a remote attacker to steal a key directly. So the entire "don't put nsecs in apps" is kind of a moot point. If the app developer takes basic precautions and don't be insane the odds of the key being lost is pretty small. The real risks are: - web apps, as they come with a bunch of risks related to web and how it executes scripts from whatever sources in many circumstances. - evil apps that will steal your key on purpose. - physical access to the device. - CIA-sponsored (or not) remote takeovers of your entire OS. Amber/NIP-55 defends against the first two of these, but against the next two the only solution is a bunker. If you are