Security

How to report vulnerabilities responsibly and what QRCodePlus protects on public tools, admin access, and infrastructure.

Last updated: September 3, 2026

We take the security of QRCodePlus seriously. This page explains how to report issues, what is in scope, and how we handle confirmed vulnerabilities. If you discover a weakness, please report it privately so we can investigate and remediate before public disclosure.

How to report

Email [email protected] with the subject line “Security report”. Clear, actionable reports help us reproduce and fix issues faster. Include as much of the following as you can:

  • A concise description of the vulnerability and its realistic impact.
  • Step-by-step reproduction instructions — URLs, HTTP requests, screenshots, or a short video if helpful.
  • Affected component — public site, admin panel, upload flows, API endpoints, or infrastructure.
  • Your contact information for follow-up, if you are willing to provide it.

Do not post vulnerabilities publicly on social media, issue trackers, or forums before we have had a reasonable chance to respond. For urgent active exploitation, mention “urgent” in the subject line.

What we prioritize

We focus remediation on issues that could meaningfully harm users, operators, or service integrity:

  • Exposure of personal data, session tokens, or admin credentials.
  • Authentication bypass, privilege escalation, or broken access control on admin functions.
  • Remote code execution, server-side injection, or unsafe deserialization.
  • Cross-site scripting (XSS) or CSRF that affects authenticated admin workflows.
  • Widespread abuse of translation jobs, media uploads, or code-generation endpoints.
  • Misconfiguration that leaks source code, environment secrets, or database backups.

Out of scope

The following reports are generally out of scope or lower priority. We may still note them for hardening but may not respond individually:

  • Missing security headers on static assets where no exploitable impact is demonstrated.
  • Self-XSS requiring a victim to paste attacker-controlled code into their own browser.
  • Rate limiting or denial-of-service findings without a practical, low-volume proof of concept.
  • Content or phishing encoded in QR codes or barcodes that users generate themselves — see our Terms of Service for acceptable use.
  • Vulnerabilities in third-party analytics, fonts, or CDN assets we do not control.
  • Social engineering, physical attacks, or spam sent through public contact forms.

What we protect

Public generators and scanners

Core QR and barcode tools are designed to run in your browser. We do not store the payloads you type for later retrieval. Security work focuses on preventing server-side leakage, unsafe file handling, and abuse of download or scan endpoints. See our Privacy Policy for data-handling details.

Administration and content

The admin panel is restricted to authorized operators. We protect login sessions, CSRF tokens, translation workflows, and media uploads. Reports involving admin-only routes should include whether an unauthenticated or low-privilege user can exploit the issue.

Infrastructure

Production systems use standard hardening: HTTPS, access controls, and logging for security monitoring. We rotate credentials when incidents require it and patch dependencies as part of regular maintenance.

What we ask of researchers

  • Act in good faith — do not access data that is not yours or disrupt production services.
  • Use test accounts or your own content when demonstrating an issue.
  • Give us reasonable time to confirm and fix validated findings before public disclosure.
  • Do not perform social engineering against our team, users, or partners.
  • Comply with applicable laws in your jurisdiction.

Safe harbor

We will not pursue legal action against researchers who report issues in good faith, follow this policy, avoid privacy violations, and do not intentionally degrade service availability. Safe harbor applies to research conducted on qrcodeplus.net and related properties we operate — not to third-party services linked from generated codes.

Response timeline

We aim to acknowledge reports within a few business days. Complex issues may require additional time to reproduce, patch, and deploy. We will keep you informed when you provide contact details. We do not operate a paid bug-bounty program at this time, but we appreciate responsible disclosure and may credit researchers who wish to be named after a fix is deployed.

Contact

Security reports: [email protected] (subject: “Security report”). General questions: Contact. Privacy matters: Privacy Policy.