--- title: "Redirect page hardened — target URLs are now escaped — qr3.app" description: "A gap in the interstitial page shown before redirects is closed; every redirect response now carries HTTP security headers." canonical: "https://qr3.app/el/changelog/2026-08-redirect-security-headers-en/" lang: "el" --- # Redirect page hardened — target URLs are now escaped — qr3.app > A gap in the interstitial page shown before redirects is closed; every redirect response now carries HTTP security headers. Canonical: 2026-08 · Security headers # Redirect page hardened — target URLs are now escaped 21 Αυγούστου 2026 security redirect Scanning a code on the Free plan briefly shows a qr3-branded interstitial page that displays where you are being sent. That **target URL was printed unescaped**. A URL with embedded markup could therefore run in the scanning person’s browser. Two things changed. First, the display now escapes every target URL, whatever it contains. Second, a **Content Security Policy** on that page forbids script execution entirely — the page carries no JavaScript of its own, so the strict rule costs nothing and catches any path we might miss in future. **We checked whether the gap was ever used: it was not.** Not a single redirect target, A/B target, landing page configuration or stored filename contains markup. There is nothing for you to do, and no codes need to be recreated. ### Also new Every response from the redirect infrastructure now carries HTTP security headers — protection against content sniffing and clickjacking, HSTS, plus referrer and permissions policy. Dashboard, documentation, website and redirects are now covered end to end. For **uploaded files** served from a code’s mini landing page there is one more change: they go out with `X-Content-Type-Options: nosniff`, so the browser can no longer guess at the file type. Formats with no meaningful in-browser view are delivered as a download rather than as page content. PDFs, images and video still display directly, and datasheets you embed on your own website keep working unchanged. [Πλήρης τεχνική τεκμηρίωση →](https://docs.qr3.app/en/changelog/) [← Όλες οι καταχωρήσεις](/el/changelog/)