Seven claims hold up our login.
Break one.

qID Connect is post-quantum sign-in for BTX. Before the world gets it, our friends get to attack it.

We do not say unhackable. We say: here is exactly what we claim, here is the code, prove us wrong. An independent audit is coming; the sharpest eyes we know get to go first.

The claims

A sign-in can never move funds.

Login proofs are signed in a separate cryptographic domain from transactions, and no shipped signer will sign caller-supplied bytes.

BREAK IT: produce a login interaction that yields a signature the chain accepts as a spend.

A proof works on one site, once.

Server-issued single-use nonces, exact origin binding, a five minute window on a signed timestamp.

BREAK IT: replay a captured proof, or make a proof for site A log you in on site B.

The QR flow cannot be hijacked from the side.

The QR never contains the session secret. Only the browser that requested the challenge can claim the session, exactly once. Signers refuse proof delivery to any address that is not the asking site itself.

BREAK IT: photograph, relay, or craft a QR that gets you someone else's session.

Sessions cannot be forged.

Signed tokens with the algorithm pinned, expiry enforced, constant-time verification.

BREAK IT: mint, alter, extend, or downgrade a session token without the server secret.

The server knows no secrets worth stealing.

No passwords, no emails, no keys. A fully compromised integrator server yields that site's sessions and nothing about any wallet.

BREAK IT: extract anything from the server side that endangers a wallet.

Malformed input cannot get through.

Every parser fails closed. Broken proofs, hostile envelopes, and junk tokens resolve to clean rejections.

BREAK IT: find an input that crashes a component or verifies when it should not.

The frozen verifier is the whole truth.

Verification is a byte-pinned reference implementation constrained by a published vector set. No input reaches acceptance around it.

BREAK IT: make the verifier accept what the vectors say it must reject.

Rules

In scope: the qID Connect server SDK, widget, signer rules, and the demo apps. The qid cryptography core has its own audit track.
Out of scope: denial of service, social engineering, physical access, and anything against systems you do not own or have permission to test.
This is a private preview. What you see and what you find stays between us until release.
Report what you find through qid.dev. A clean reproduction is worth more than a theory, but sharp theories are welcome too.

What you get

Named credit alongside the audit when qID Connect goes public, first access to everything we build, and our honest gratitude with something real attached: serious findings before launch are rewarded case by case. When the project goes open source, a formal paid bounty program replaces this page.