@Codeberg Kinda odd that the QR-code doesn't contain just a digital signature or something similar, and that their ticket-checking app might be vulnerable to it containing something malicious, like opening a random malicious URL.

I suppose it was just "QR code bad" and the policy wasn't thought through much more than that?