Please report vulnerabilities in the clients or the QRFLOW.codes API privately to hello@qrflow.codes. We answer within one business day and credit reporters who want credit. Do not open a public issue for security reports.

Keys: never commit a qrf_live_… key or a whsec_… webhook secret. If one leaks, revoke it on the Account page; the effect is immediate.