@darius yeah, as far as I can tell the problem isn't anything to do with the QR code, it is applications that decode them and act without confirmation, like opening a link just by scanning it without anything else.