The concern was legitimate.

When I introduced a free QR contact card for DDNYC 2026, some members of the community were uneasy. QR codes have been placed over legitimate parking-meter codes, sent inside phishing messages and used to hide destinations until the moment a phone decodes them. The Federal Trade Commission advises people to inspect the URL before opening an unexpected QR destination. The FBI likewise recommends verifying a QR code’s source through another channel before entering credentials or downloading files.

My first reaction could have been disappointment: this was meant as a small, useful gift for a community I know. The better reaction is gratitude. A security concern voiced early is the community doing its job.

So let me state the most important point plainly: a QR code is not a trust signal. It is a compact way to encode information—often a web address. Trust must come from the destination, the requested action, the surrounding context and the ability to verify all three.

The 20-second DDNYC check

  • Confirm the camera preview says anthemhayek.com—spelled exactly that way.
  • Expect a contact preview for Anthem Hayek Blanchard, not a login or payment page.
  • Never enter a password, wallet connection, seed phrase, private key or payment information.
  • Do not install an app or change a security setting.
  • Review the contact fields, then choose whether to save. The QR cannot silently add the contact.
  • If anything differs, close it and ask me directly.

The objection is correct

A malicious QR code can send a person to a convincing imitation of a trusted website. It can disguise a credential-harvesting page, initiate a download or exploit the fact that people tend to act quickly on phones. A sticker can also be placed over a legitimate printed QR code. These are real attack paths, not abstract objections.

A sold-out paid event does not change those technical facts. Neither does membership in the Doginal Dogs community. A circle of trust adds social accountability: people know one another, can ask questions and can verify a code with the person presenting it. That is valuable. It is not cryptographic protection, and non-community attendees deserve the same ability to verify the utility without relying on personal familiarity.

What this QR actually does

The published QR resolves to one fixed HTTPS destination:

https://anthemhayek.com/anthem-hayek.vcf?v=12

The ?v=12 portion is a cache version. It does not redirect to a different domain. The endpoint returns a file labeled text/vcard and presented as an attachment. A vCard is structured contact data, not an executable application—but contact parsers are still software and can contain bugs, which is one reason to keep phones updated. The phone shows a preview containing my name, organization, phone, email, website, optional PFP and social profiles. The recipient must still tap to create or update a contact.

The response is also sent with no-store caching, no-sniffing, no-indexing and a restrictive content security policy. Those headers are defense in depth. They do not substitute for checking the domain and the requested action.

Expected domainanthemhayek.com
Expected filetext/vcard
RedirectNone at the QR destination
Login requiredNo
Wallet or paymentNo
Final saveRecipient confirms

The safeguards—and their limits

1. The destination is visible and specific. The share image prints ANTHEMHAYEK.COM beneath the QR. A scanner should show the same domain before the recipient proceeds. A look-alike spelling is a stop signal.

2. There is no open redirect. The QR points directly to the vCard endpoint. It does not accept a user-supplied destination or bounce through a link shortener. This removes a common way a once-trusted link can be repointed.

3. The flow requests no high-value secret. The expected action is review-and-save contact information. The utility does not need a login, wallet signature, payment, seed phrase, private key, app installation or security-setting change. Any such prompt means the reader is no longer in the expected flow.

4. The application has no account, form, analytics script or database. The generator runs locally, and the public contact flow has no first-party tracking code. But “no application tracking” is not the same as “no infrastructure metadata.” AnthemHayek.com is delivered through Cloudflare. Like other network providers, Cloudflare may process ordinary request metadata such as IP addresses, URLs, timestamps and device or routing information under its own policies. I have updated the kit copy to make that distinction explicit.

5. HTTPS protects the connection, not the reader from every bad idea. Cloudflare supplies the HTTPS connection for anthemhayek.com. TLS helps a phone authenticate the domain and protects traffic against eavesdropping or alteration in transit. It does not certify that every file on a domain is benevolent. The hostname and the expected behavior still matter.

6. The source and contract are inspectable. The generator, configuration schema, tests, license, agent instructions and machine-readable manifest are public. The automated test decodes the finished QR and checks that it equals the intended HTTPS vCard URL. Open source makes independent inspection possible; it does not magically make code secure.

7. There is now a disclosure path. The site publishes an IETF-style security.txt file so a researcher or attendee can report suspected tampering, an unexpected redirect or another security issue through a known channel.

What MIT means—and does not mean

The kit is released under the MIT License. That means people may inspect, use, modify, teach, distribute and incorporate the code into commercial work while preserving the license notice. It also means the software is provided “as is,” without a warranty. MIT is a permission structure, not a security certification.

That distinction matters for forks. A third party may modify this kit and publish a different QR destination. The safety claims on this page apply to the version hosted on anthemhayek.com and to the controls described here. They do not automatically transfer to every derivative.

A machine-verifiable receipt

The project now publishes a live verification document containing the exact QR destination, expected media type, current vCard SHA-256 digest, expected user flow and actions that should never be requested. It is readable by humans, LLMs and automated tools:

Open the live verification JSON →

The source manifest independently lists the raw project files and their checksums:

Open the source manifest →

Practical guidance at DDNYC

I will favor showing the QR from my phone rather than leaving an unattended printed code where a sticker could be placed over it. If I use printed material, the expected domain will be printed beside the code and the material should remain under human supervision.

Attendees should scan only when the context makes sense, inspect the destination before opening it and review the contact before saving. Keep the phone’s operating system current. If a code appears damaged, covered, replaced or disconnected from the person it claims to represent, do not use it.

Most importantly, there is no urgency. A legitimate contact exchange can survive a ten-second verification. Phishing often depends on hurry, authority or fear. This utility needs none of those.

Trust should make verification easier

The purpose of a trust circle is not to make questions impolite. It is to make truthful answers easier to obtain.

I still believe this is a useful application: scan, review, tap and save. I also believe the community was right to ask what sits behind the square. The responsible answer is not “QR codes are safe.” It is: this is the exact destination, this is the exact action, this is the source, these are the limits, and this is how to stop if anything changes.

Truth. Joy. Receipts. In this case, the receipt is the URL.

Verify or download

Sources

Disclosure: I created and host this utility, am a CryptoSpaces Network host, an active Doginal Dogs community member and a listed DDNYC panelist. This document is my project’s security position, not an independent audit, guarantee or warranty. Report suspected problems through the published security contact.