Scan QR
Threat Defense

Security Architecture

How QRPoint safeguards users from optical phishing, code execution, and data interception.

1. Defending Against "Quishing" (Optical Phishing)

Because QR barcodes represent binary data rather than human-readable text, cyber attackers sometimes use them to disguise credential harvesting portals.

QRPoint implements strict security UX across the QR Scanner:

  • No Automated Navigation: Decoded URLs are never opened automatically in your browser.
  • Isolated Target Domain: We isolate and highlight the root hostname (e.g. secure-bank.com vs secure-bank.phishing-domain.co) so users can visually verify legitimacy before navigating.

2. Protocol Filtering & XSS Sanitization

QR codes can encode arbitrary URI schemes. Attackers occasionally attempt to execute cross-site scripting (XSS) or browser exploit chains using dangerous pseudo-protocols.

QRPoint enforces strict protocol whitelisting:

  • Allowed Protocols: https:, http:, mailto:, tel:, smsto:, upi:, bitcoin:, ethereum:, solana:, and geo:.
  • Explicitly Disallowed: javascript:, data:, vbscript:, and file: schemes are strictly stripped or rendered as inert escaped text.

3. Zero-Knowledge Client Execution

Because all static barcode generation happens in the browser via JavaScript canvas and SVG generation, our edge servers never hold decryption keys, database records of your payloads, or copies of your WiFi keys. There is no central database of static barcodes to breach.

4. Reporting Security Vulnerabilities

If you discover a security vulnerability or potential threat in QRPoint, we welcome responsible disclosure at security@qrpoint.online.