Redirect page hardened — target URLs are now escaped

Scanning a code on the Free plan briefly shows a qr3-branded interstitial page that displays where you are being sent. That target URL was printed unescaped. A URL with embedded markup could therefore run in the scanning person’s browser.

Two things changed. First, the display now escapes every target URL, whatever it contains. Second, a Content Security Policy on that page forbids script execution entirely — the page carries no JavaScript of its own, so the strict rule costs nothing and catches any path we might miss in future.

We checked whether the gap was ever used: it was not. Not a single redirect target, A/B target, landing page configuration or stored filename contains markup. There is nothing for you to do, and no codes need to be recreated.

Also new

Every response from the redirect infrastructure now carries HTTP security headers — protection against content sniffing and clickjacking, HSTS, plus referrer and permissions policy. Dashboard, documentation, website and redirects are now covered end to end.

For uploaded files served from a code’s mini landing page there is one more change: they go out with X-Content-Type-Options: nosniff, so the browser can no longer guess at the file type. Formats with no meaningful in-browser view are delivered as a download rather than as page content. PDFs, images and video still display directly, and datasheets you embed on your own website keep working unchanged.