Security is the product, not a feature of it

Account & session security

• Passwords are hashed with PBKDF2 and never stored or logged in plain text.
• Optional TOTP-based multi-factor authentication (MFA), with secrets encrypted at rest via ASP.NET Core Data Protection.
• Short-lived JWT access tokens paired with rotating refresh tokens; refresh tokens are revoked on password reset.
• Login attempts are throttled per account after repeated failures, to blunt credential-stuffing attempts.

Secure QR: verification without enumeration

A Secure QR code is meaningless without the official mobile app — and that's a deliberate security property, not a missing feature. The public /secure/{identifier} landing page performs no database lookup and no verification call at all. It renders the exact same "install the app" message whether the code you scanned is genuinely valid, has been tampered with, or doesn't exist in our system at all.

Why does that matter? If the page behaved even slightly differently for valid vs. invalid codes — a different message, a different response time, a different HTTP status — an attacker could script thousands of guesses against it and learn which identifiers are real, then forge convincing fakes. By making the response identical and independent of any backend call, there's nothing to distinguish, time, or enumerate.

Actual Secure QR verification only ever happens inside the Qrauthix mobile app, over an authenticated device session, using a single-use cryptographic challenge (a server-issued nonce that is bound to the requesting device and application and can be consumed exactly once). Platform device attestation (Google Play Integrity), which would let us reject rooted emulators and repackaged copies of the app, is on our roadmap and is not enforced today.

Anti-replay & anti-abuse

• Every verification request carries a request ID; secure-verification challenges reject replayed request IDs outright.
• Challenges expire quickly and are consumed atomically on first use — a captured challenge response cannot be reused.
• Public, mobile, developer, and admin API traffic sit on independent rate-limit tiers.

Data protection & retention

• All traffic is served over HTTPS with HSTS in production.
• Sensitive fields (such as MFA secrets) are encrypted at rest.
• Verification traces, audit logs, and API request logs each have independently configurable retention windows, with automatic cleanup of data past its retention period.

Reporting a concern

If you believe you've found a security issue in Qrauthix, please contact us directly rather than filing a public report — we take these seriously and will follow up promptly.