Security
Where to report
Write to support@verdettoqr.com with "Security" in the subject. The same address is in the site's security.txt. Say what you found, how to reproduce it, and which version or page. Please do not include other people's data, and please do not test against anyone else's phone or account.
Good-faith research within this scope, without touching other people's data or devices, is welcome, and we will not take legal action over it.
What happens next
A person reads every report. We aim to acknowledge within three business days.
Once we have looked, you get a plain answer: what it is, whether it changes the app, the site or the safety list, and when a fix ships.
We ask for ninety days before you publish the details, so a fix can reach phones first; if we need longer, we say so and why. We name reporters in the release notes when they want to be named, and never when they do not.
What is in scope
The Android app, this website, and the safety-list pipeline at github.com/verdettoqr/link-safety-list. A wrong result on a scanned code, or a site or link that should be on the warning list or should not, goes through the report page; the app's own Report action opens it. The services the online lookups reach belong to their owners; a problem there goes to them.
How the pieces are built
Scanning and every built-in check run on the phone. A newer safety list downloads as a signed bundle; the app checks the signature and every file's hash before using it, and a bundle that fails the check is discarded while the last good one stays in use. The only requests the app makes on its own are the safety-list download and the online lookups, both under one switch; Google Play's own billing client checks the support purchase when the app starts, and anything you tap to open goes through your browser. A lookup carries the scanned number or address (for a vehicle, the year, make and model worked out from it), the app's name and version, our support address and, for a product lookup, the app's language; nothing else about you or your phone. The app has no accounts and no analytics. The threat model, and how the signing keys are handled, ship with the source code when it is published.
What we never say
That a code, a link or a site is safe. The app shows what was checked and what was found; the decision stays with the person holding the phone.