Nostr: What does it take to secure a relay?

Short answer

Keep its server and relay software updated, restrict administration, monitor storage and abuse, and publish clear access rules. Protect any keys or credentials used for management and back up data you promise to retain. NIP-11 can advertise capabilities and contact details, but an information document is not a security control. Threats and costs depend on whether the relay is private, public, or paid.

Sources

NIP-11: Relay metadata, NIP-01: Basic protocol.