Deterministic QR Verification & Phishing Defense
SafeScan evaluates QR payloads through an offline multi-stage security pipeline. Detect quishing vectors, validate HMAC cryptographic tokens, and neutralize SSRF threats without ever navigating to untrusted destinations.
Multi-Stage Inspection Pipeline
Automated three-tier evaluation applied to every ingested payload
Syntax & Protocol Deconstruction
Extracts scheme, port, and IP representations. Flags numeric IP hosts, credentials in authority, non-standard URL schemes, and obfuscated formats.
Session HMAC & Anti-Replay
Verifies HMAC-SHA256 digital signatures for attendance and event sessions. Atomically marks one-time tokens in database transactions to prevent replay attacks.
Threat Intel & Risk Scoring
Queries local threat indicators and reputation sets. Synthesizes deterministic 0–100 risk score and plain-English safety recommendations.
Security Capabilities
Engineered for security teams, university lectures, and high-risk scanning scenarios
Offline SSRF Immunity
Parses and validates domain components without making risky HTTP requests from the host server, preventing server-side request forgery.
Cryptographic HMAC Tokens
Context-bound attendance tokens are mathematically signed using secret keys, preventing unauthorized payload forgery.
Atomic Anti-Replay Engine
PostgreSQL-level transaction locking enforces one-time token redemption so projected QR codes cannot be re-scanned or shared.
Deterministic Risk Scoring
Hard-fail security rules paired with transparent scoring (0–100) and human-readable explanations instead of black-box heuristics.
Dual-Engine Capture
High-performance in-browser ZXing scanner for live device cameras alongside server-side image processing for screenshots.
Privacy Masking & Audit Trail
Payloads and sensitive destination URLs are masked before audit logging; raw camera frames and images are never stored on disk.
Ready to inspect a QR payload?
Use your live camera, drop an image file, or test sample threat payloads in debug mode.