Connect to `btp.securityops.co`

Three ways to read this origin, depending on how much trust you want to put in this server.

Option 1 — Browser shim (easiest, lowest guarantees)

Open https://btp-gw.securityops.co in any browser. The gateway fetches the BTP content, verifies the signature server-side, and renders HTML for your browser.

Trust model: you trust this server (the gateway) to not lie about signature validity. The signature is real, but you don't see the bytes — you see HTML the gateway generated.

Option 2 — Android app (signature-verified locally)

The BTP Android app fetches via the gateway (HTTPS), then verifies locally any .btp file shared in from a contact, or opened directly via the Library tab's upload button. The compose + sign + share path is fully on-device.

https://git.securityops.co/cristiancmoises/btp-app/releases

Download the latest release APK matching your device's ABI (arm64-v8a or armeabi-v7a), enable "Install unknown apps" for your file manager, then open the APK. The app appears as "BTP" in your launcher.

Option 3 — Native desktop client (full guarantees)

The terminal renderer btpview speaks BTP over raw TCP, performs the ML-KEM key exchange, verifies the ML-DSA-87 signature, and prints the document.

Linux / macOS

git clone https://git.securityops.co/cristiancmoises/btp
cd btp
cargo build --release --no-default-features -p btpview

./target/release/btpview --pq btp://btp.securityops.co:3004/

Pin the fingerprint

First-time clients should pin the origin's fingerprint to detect future tampering:

./target/release/btpview \
    --pq \
    --fingerprint 7f24c0a217230af47f795bab43240389e46ca103685ff45baa4048825a50a129 \
    btp://btp.securityops.co:3004/

What if the fingerprint doesn't match?

Either the key rotated (the operator should announce this in advance) or someone is impersonating the origin. The client refuses the connection in either case until you explicitly accept the new fingerprint.

Connect to btp.securityops.co