Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
Just over 23 hours later and my QR code in my downloads folder has still not been "tripped". I guess I have another 24 hours before my requestbin expires but so far it seems there has been no reproduction of this.