Until someone with more details can step in, I've seen several sources showing nostr dms as presently implemented are insecure as the sender and recipient are visible. I am unsure if the content is visible.

Please correct me, anyone with more details.