For creators
Use HTTPS destinations you control, restrict account access with MFA, review redirect changes, keep an asset inventory and remove abandoned campaigns before domains or paths can be reused.
Security guide
QR code security guide
A QR code is a transport layer for data. Security depends on what is encoded, who controls the destination, how redirects are governed and what users see before opening it.
For scanners
Preview the domain, reject look-alike hosts, avoid entering credentials after an unexpected scan and use the operating system camera or a trusted scanner with URL preview.
For dynamic QR platforms
Protect redirect administration, log changes, rate-limit abuse, screen malicious destinations, keep stable public identifiers and provide rapid suspension and incident-response paths.
Incident response
Freeze redirect changes, preserve audit logs, disable the affected destination, notify asset owners, rotate credentials and publish a replacement only after the root cause is removed.