Security

Authentication uses email magic links via Supabase. A signed-in account is required before any QR file download. Row Level Security isolates your codes and scan data.

Before download we validate payload fields, scannability contrast, block dangerous URL schemes (javascript:, data:, …), rate-limit export attempts, and (when deployed) call Worker /api/url-check with your session — optional Google Safe Browsing blocks known malware when configured.

Report vulnerabilities to security@xeon360.com. Do not attempt unauthorized access — we rate-limit redirects and monitor abuse.