Embedro
QR
Technical Infrastructure Documentation

Security Architecture & Data Handling

Technical specifications governing data isolation, network communications, API credential management, and external threat screening on Embedro QR.

1. Local Direct Matrix Processing & Data Isolation

In static mode, spreadsheet parsing (CSV, TSV, XLSX) and QR image rendering execute entirely within the client's local browser runtime via Web Workers. Row records, customer destination URLs, and metadata are not transmitted to or stored on Embedro application servers.

Manifest Data Scrubbing:

In static bulk mode, dynamic configuration columns (Passwords, Expiry Dates, and Scan Limits) are excluded from the exported manifest.csv file, preventing plain-text credential persistence when distribution archives are sent to printing facilities.

2. URL Validation & Threat Detection

Every dynamic redirect target submitted through the web interface or REST API undergoes validation prior to record creation:

  • Protocol Restriction: Only standard http:// and https:// destinations are accepted. Non-web schemes (javascript:, data:, vbscript:, file:) and loopback/private RFC 1918 subnets are rejected.
  • Google Cloud Web Risk API: Dynamic destinations are checked via webrisk.googleapis.com/v1/uris:search against Google threat intelligence feeds for malware, social engineering/phishing, and unwanted software.
  • Formula Prefix Escaping: Exported spreadsheet fields starting with formula trigger characters (=, +, -, @) are escaped to mitigate CSV injection risks in external spreadsheet applications.

3. API Authentication & Token Handling

Developer API credentials utilize 192-bit CSPRNG entropy generated with prefix emb_live_ (production) or emb_test_ (sandbox).

  • SHA-256 One-Way Hashing: Plain-text API keys are displayed once upon initial generation. Database records store only cryptographic SHA-256 hashes (key_hash) and truncated display prefixes.
  • Key Revocation: API keys can be revoked through the developer console or DELETE /api/keys endpoint, immediately terminating authorization.
  • Rate Throttling: API requests are metered using sliding 60-second windows with standard RFC response headers (X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After). Accounts are restricted to a maximum of 5 active keys.

4. Scan Telemetry & IP Anonymization

Dynamic QR redirection collects pseudonymized aggregate metrics: scan timestamp, device category, operating system, and approximate country. Raw IP addresses are not stored in database tables; visitor IPs are passed through a salted SHA-256 one-way hash function to tally unique visits. Granular scan events are purged after 90 days.

Vulnerability Reporting & security.txt

We review technical vulnerability submissions regarding our web application and API infrastructure. Submit reports through our Contact & Vulnerability Disclosure form.

Machine-readable vulnerability disclosure parameters are published per RFC 9116 at /.well-known/security.txt.