ovbq home

Security

This page lists what ovbq does today to protect your account and the people who scan your codes. If something here is not true, please tell us.

Signing in

  • There is no account sign-in password. We email you a sign-in link that works once and expires after 15 minutes.
  • We store only a scrambled, one-way copy (a hash) of each link's secret, never the secret itself.
  • Opening the link shows a button you press to finish. Email scanners that open links in advance cannot use up your link.
  • Sign-in requests and abuse reports are limited to a set number per hour.
  • Your cookie cannot be read by scripts. Browsers do not send it when another site submits a form to ovbq.com or loads ovbq.com inside its own page. They do send it when you click a link to us, so you stay signed in. On our live site it is named __Host-ovbq. The __Host- prefix requires HTTPS.
  • Every form that changes something is protected against forged requests. Most carry a secret token; the free maker's "Make it editable" button, which only starts sign-in, is accepted only from ovbq.com pages.

The website

  • Over HTTPS, browsers are told to use HTTPS for ovbq.com from then on.
  • Pages load no third-party scripts, fonts or trackers. Everything comes from ovbq.com.
  • A strict content security policy blocks scripts from anywhere else, and our pages cannot be framed by other sites.
  • Card payments happen on Stripe's pages. Your card number never reaches our servers.

Where codes can point

  • An editable code can open a link that starts with http:// or https://, a phone call (tel:), a text message (sms:) or an email (mailto:). We refuse any other kind of link.
  • A call or text code must hold one phone number, and an email code one email address. We build the address the code opens from them, so nothing typed can add another recipient.
  • Links to private or local network addresses are refused, and so are links with a username or password inside them.
  • Pages we host (text pages, Wi-Fi pages, contact cards, app download pages, menu pages, link-in-bio pages and coupon pages) are served from ovbq.com with an even stricter content security policy than the rest of the site. Links on them follow the rules above, store links must be on the App Store or Google Play itself, and the pages don't tell the sites they link to which page sent the visitor.
  • Files we host (PDFs, JPEGs and PNGs) are checked by what they contain, not by their name. We re-save every image, which removes hidden data such as a camera's location, and we don't host PDFs with scripts, forms or attached files. They are stored outside the public web folder and served by our own code with a strict content security policy, and each comes with a Report this file link.
  • Anyone who can open a Wi-Fi page can see the network password, just like a printed Wi-Fi sign. Its owner can put the network password behind a "Show password" button, so it isn't on screen until a guest asks for it; that button does not restrict access. A code's saved pauses and access restrictions still apply. Only use a Wi-Fi page for a network you're happy to share. The network password is never put in a link.
  • Anyone can report a harmful code. We can switch off a code that breaks our rules. A switched-off code shows a page saying it is no longer active.
  • A deleted code's short link is never given to anyone else, so an old print can never lead to a stranger's page.

Scan data

  • We do not store the IP address of people who scan a code. We look up only its country, on our own server, for codes on Pro and Business, and keep only the two-letter country code.
  • To count different visitors, we keep a one-way hash of the IP address mixed with a random value. That value changes every day. Each day's value is deleted once that day is more than two days old, so about three days after it was made.
  • Redirects set no cookies.
  • CSV exports guard cells that start like a spreadsheet formula, so opening one cannot run a formula.

The free maker

We do not save what you type into the free QR code maker on the home page. The code is made and sent back to you, and what you typed is discarded. The one exception is "Make it editable": then we keep only the web address and the strength setting until you sign in, and delete them within about a day, so we can make the editable code after you sign in.

Found a problem?

Please write to hello@ovbq.com with the details. Do not test against other people's accounts or codes.