Security: what we do against QR code phishing
A dynamic QR code is a redirect. Like any link shortener, it can be abused to send people to a deceptive site. Here's exactly what Scanolo does to prevent that, and what we can't guarantee.
Destination checks
Every destination address is analyzed when the code is created, on every edit, then regularly for as long as the code is active. The analysis combines local rules with a check against lists of malicious sites.
- Raw IP addresses, domains using deceptive characters (punycode), chains of shorteners, unusual ports: flagged as suspicious
- Login-related keywords (sign in, password, bank) on an unknown domain: flagged as suspicious
- A domain found on malicious-site lists: blocked
- Only http and https are accepted as destinations
What the person scanning sees
A verified link redirects immediately. A suspicious link shows an interstitial page that states the destination domain and lets the person choose whether to continue. A blocked link shows a warning page with no clickable link. In every case, a button lets them report the code.
What we don't store
Scans are counted with no cookie and no personal identifier. The IP address is used to compute a daily unique-visitor count as a non-reversible fingerprint, then isn't kept in plain form.
Account security
Passwords hashed with Argon2, server-side encrypted sessions, a list of active sessions with revocation, email confirmation for account deletion, API keys shown once and stored hashed.
Limits
No automated check is perfect. A site that's clean at the time of the check can turn malicious afterward; that's why checks repeat and why public reporting exists. We don't guarantee the total absence of abuse, we guarantee acting fast once it's detected or reported.