# QR Code Safety Lab methodology

## Release

- Release: 2026-07-20-v1
- Published: 2026-07-20
- Updated: 2026-07-20
- Publisher: QR Code Crafter, a service of Brand Aspect Ltd
- Results: 10 of 10 fixtures matched the published expectations
- Dataset: https://qrcodecrafter.com/data/qr-safety-lab-v1.json
- Results page: https://qrcodecrafter.com/qr-code-safety-lab

## Method

Each fixture is passed to reviewScannerPayload in the deployed source. The check is deterministic and local: it does not request, resolve, or verify a destination.

The checker evaluates only the decoded payload string and URL structure. It classifies the payload type, applies the structural rules in the deployed QR Code Crafter scanner, and compares the observed classification with the expected result recorded in the fixture set.

## Published structural signals

- Clear: no rule in this release matched the decoded structure. This is not proof that a destination is safe.
- Caution: the structure uses HTTP, a known URL shortener, punycode, a public IP address, or tracking parameters and should be reviewed before opening.
- Blocked: the structure contains embedded credentials, a private or loopback network target, or control characters, so the scanner disables direct opening.
- Non-web intent: the payload invokes another scheme, such as email, and is not treated as direct web navigation.

## Reproduce the release

1. Open https://qrcodecrafter.com/qr-code-safety-lab and download the JSON dataset or printable test sheet.
2. Scan each published fixture with the QR Code Crafter scanner.
3. Compare the displayed payload type, review level, and warnings with the expected and observed fields in the dataset.

## Limitations

- The release does not visit destinations, follow redirects, query reputation services, inspect page content, or detect malware.
- A clear structural result is not a security certification, endorsement, or guarantee.
- Scanner, browser, operating-system, and device compatibility are outside this release.
- Results describe the published rule set and fixture inputs only.

## Corrections

Report a reproducibility problem, incorrect fixture, or factual error to contact@qrcodecrafter.com. Include the release identifier, fixture ID, observed result, and enough detail to reproduce the issue. Material corrections will be reflected in a dated release update.