Skip to content
QRaft

Security policy

Last updated

How the site is built to be safe

  • Local processing. Code generation, scanning, decoding and conversion happen in your browser, so the sensitive things you work with (Wi-Fi passwords, contact details, images, camera video) are not transmitted to or stored on our servers.
  • Encrypted connections. The site is served over HTTPS with HTTP Strict Transport Security.
  • Restrictive security headers. A Content Security Policy limits where scripts, images and frames can load from; framing by other sites is blocked; MIME sniffing is disabled; and camera access is limited to this site.
  • Safe file handling. Uploaded logos are limited in type and size and re-encoded as fresh images before use. Images for decoding are read locally and never executed. SVG uploads aren't accepted.
  • Careful output. Text you enter is escaped before it's placed into SVG, print and PDF output, and file names are sanitised.
  • Minimal third parties. No third-party scripts load by default. Optional analytics or ads load only with consent.
  • Protected forms. The contact and report forms validate input on the server, use spam traps and rate limits, and send plain-text email only.
  • No links opened automatically. Our scanners show the content and warning signs and let you decide.

Reporting a vulnerability

If you believe you've found a security vulnerability in this website, please tell us privately through our contact form or by email to info@biaoc.online with “Security” in the subject. Please include:

  • a description of the issue and its potential impact;
  • steps to reproduce it, and the pages or URLs involved;
  • your contact details if you'd like us to follow up.

Guidelines for research

  • Only test against your own browser session and data. Don't access, modify or delete other people's information.
  • Don't run denial-of-service tests, spam our forms, or use automated scanners that generate heavy traffic.
  • Give us reasonable time to fix an issue before disclosing it publicly.

We'll acknowledge reports, keep you informed, and credit you if you wish once the issue is fixed. We don't currently offer a paid bug bounty.

Not a vulnerability in our site?

To report a scam or malicious QR code, use Report abuse. Our guide Are QR codes safe? explains how to protect yourself.