🛡️ QR Trust (Sqanr)

A privacy-first security layer that reveals where a QR code really leads, resolves redirects, identifies threat signals, and explains risks in plain language before you open it.

---

⚡ Quickstart (Local Development)

1. Set Up Virtual Environment & Dependencies

cd backend
python -m venv venv

# On Windows (PowerShell):
.\venv\Scripts\Activate.ps1

# On macOS/Linux:
# source venv/bin/activate

pip install -r requirements.txt

2. Run the Risk Engine & Web Scanner

python run.py

• 🌐 Interactive Web Scanner: http://localhost:8000
• 📄 Interactive API Docs (Swagger UI): http://localhost:8000/docs
• 🩺 Health Check: http://localhost:8000/api/v1/health

3. Run Automated Tests

pytest tests/ -v

---

🧩 Architecture Highlights

1. Async Redirect Tracer: Follows up to 10 redirect hops, unpacks URL shorteners (bit.ly, tinyurl, qr.codes), and guards against SSRF (private IPs, loopback, link-local).
2. Local Heuristic Detection:
   • Brand Impersonation & Typosquatting: High-precision checks against major brands (PayPal, Google, HDFC, SBI, Microsoft, etc.).
   • Payload Danger: Detects direct .apk, .exe, .msi, .bat downloads.
   • Character Spoofing: Homoglyph & Cyrillic Punycode disguise detection.
   • URL Obfuscation: Detects embedded credentials (user:pass@domain) and suspicious TLD patterns.
3. Live Threat Feeds: Real-time Abuse.ch URLhaus query + optional Google Safe Browsing v4 integration.
4. Calibrated Verdicts: Uses honest security language ("No known threat found" vs "100% safe").
5. Zero Infrastructure Cost: Runs locally on free tiers (Fly.io, Railway, Supabase).