Security

Last updated: 20 February 2026

Security here is mostly about restraint: the fewer sensitive things we hold, the less there is to lose.

Data minimisation

Generation, scanning and bulk exports run in your browser. Wi-Fi passwords are stripped before a code is saved, camera frames never leave your device, and scan analytics record no IP addresses or personal identifiers.

Account protection

Passwords are hashed by our managed authentication provider; we never see them.
Email verification is required before an account becomes active.
Google sign-in is available if you prefer not to manage another password.
Sessions are stored locally and can be ended at any time by logging out.

Data isolation

Every table storing user content enforces row-level security, so a request can only ever read or write rows belonging to the authenticated user. Privileged helper functions are kept out of the public API surface, and scan events are write-only from the server.

Transport and infrastructure

All traffic is served over HTTPS. The application runs on managed edge infrastructure with automated patching and backups of the database.

Responsible disclosure

Found a vulnerability? Email support@barcodeqrhub.com with steps to reproduce. Please give us a reasonable window to fix the issue before publishing, and avoid accessing other people's data while testing. We will acknowledge reports and credit researchers who ask to be named.