security issues and unique qr code path