The system follows the best practices of the industry.
Each QR code hash is embedded in a tiny url format.
You need to be logged in to attempt brute forcing the QR codes.
Any attempt to brute force a QR code will be flagged and the account quickly blocked and the IP banned.
The number of different possibilities you could test is 1.1579209x10^77 (number of atoms the Earth is made of is estimated 10^50 for a quick comparison)
We are working on even more measures in case that wouldn’t be enough.