QR Studio is a static web app deployed continuously from main. Security fixes are applied to the latest version only, which is always the one running at https://mrcoloo.github.io/QR-Studio/.

Please do not open a public issue for security problems.

Report them privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Include a description of the issue, the steps to reproduce it and, if possible, a proof of concept.

You can expect an acknowledgement within a few days. Once the issue is confirmed, a fix will be prepared and released, and you will be credited in the release notes unless you prefer otherwise.

Examples of issues we want to hear about:

• Script injection through design content, shared design links or uploaded images
• Data leaving the browser that shouldn't (QR Studio makes no network requests with user content)
• QR codes whose encoded content differs from what the interface shows

Codes that are hard to scan because of a user's own design choices are not security issues; please report those as bugs.