1 files changed, 42 insertions, 0 deletions

diff --git a/internal/handler/websocket/handler.go b/internal/handler/websocket/handler.go
index 715e777..8daa89f 100644
--- a/internal/handler/websocket/handler.go
+++ b/internal/handler/websocket/handler.go
@@ -299,6 +299,13 @@ func (h *Handler) handleEvent(ctx context.Context, conn *websocket.Conn, raw []j
         pbEvent := NostrToPB(&event)
         canonicalJSON := event.Serialize()
 
+        // Reject non-core protocol kinds (spam, ephemeral, chat)
+        if !isAllowedKind(pbEvent.Kind) {
+                status = "ok"
+                h.sendOK(ctx, conn, event.ID, true, "rejected: kind not supported")
+                return nil
+        }
+
         // Handle deletion events (kind 5) - process but don't store
         if pbEvent.Kind == 5 {
                 if err := h.store.ProcessDeletion(ctx, pbEvent); err != nil {
@@ -564,3 +571,38 @@ func getClientIP(r *http.Request) string {
         // Fall back to RemoteAddr (direct connection or proxy IP)
         return r.RemoteAddr
 }
+
+// isAllowedKind returns true if the event kind is a core Nostr protocol kind.
+// Rejects spam, ephemeral events, live chat, and other non-essential kinds.
+func isAllowedKind(kind int32) bool {
+        // Core protocol kinds (NIP-01, NIP-02, etc.)
+        switch kind {
+        case 0: // Metadata/profile
+                return true
+        case 1: // Short text note
+                return true
+        case 3: // Contacts/following
+                return true
+        case 4: // Encrypted DM
+                return true
+        case 5: // Event deletion (handled separately)
+                return true
+        case 6: // Repost
+                return true
+        case 7: // Reaction
+                return true
+        case 9735: // Zap
+                return true
+        case 10000, 10001, 10002: // Mute lists, pin lists (NIP-51)
+                return true
+        case 10050: // Relay list metadata
+                return true
+        case 30023: // Long-form content (NIP-23)
+                return true
+        case 30078: // Application-specific data (NIP-78)
+                return true
+        default:
+                // Reject everything else (chat, ephemeral, spam)
+                return false
+        }
+}