QR codes and clipboard imports can expose server credentials

Steps

Display a QR only on trusted devices in private. Screen sharing, livestream recording and automatic photo backup can copy it.
After clipboard import, overwrite the clipboard with non-sensitive text; remember cloud clipboard and cross-device sync.
Never post a complete share link in a forum. Preserve protocol and error fields but replace domain, UUID, password and local path.
If exposure is possible, rotate UUID, password or token on the server and invalidate the old value. Local deletion does not revoke it.

Anyone holding the link may consume your quota and connect under your identity. Treating it like a password is cheaper than investigating abuse.

Public screenshots and logs cannot reconstruct an endpoint or credential, and rotated links no longer connect.

Blurring a small QR area is unreliable because error correction may still recover the encoded data.