Security

Two separate keys, so a public QR code can never open the dashboard.

Path 1 - the attendee link

Path 2 - the dashboard link

How it works

Two unrelated links. The check-in link in the QR code and the organizer's dashboard link are generated separately from a cryptographic random source. One cannot be derived from the other.
Dashboard link stored as a hash. The server keeps only a SHA-256 hash of the dashboard token, so a database leak does not reveal working dashboard links. Anyone who holds the full link can manage that check-in, so keep the email private.
Links expire. The dashboard link stops working after 7 days. Organizers can request a fresh link by email, and the old one stops working.
CSRF protection. Every form carries a signed token tied to the browser, and the server also checks that the request comes from this site.
Rate limiting. Creating check-ins, submitting names, sending emails, exporting and failed dashboard attempts are all limited per client, using a keyed one-way hash of the network address.
Strict browser policy. The site sends a strict Content-Security-Policy (no inline scripts, no third-party resources), HSTS, no-referrer, frame blocking and no-store caching, so private links are not leaked to other sites or cached.
Safe exports. CSV and Excel exports neutralise cells that start with =, +, - or @ so a malicious name cannot run as a spreadsheet formula. Exports contain attendance only, never security data.
No accounts, no passwords. There is nothing to phish or reuse. The database and mail credentials live only in a private server configuration file.

Anyone who scans the QR code can check in. The service cannot verify identity or location. Closing the check-in, or setting a capacity, limits this.
Duplicate checks are best effort. They use a random cookie on the attendee's device, and optionally the email address. A person using another device or a private window can check in again.
Email is not end-to-end encrypted. The dashboard link travels through your email provider. Treat that message like a password.
The server can read attendance data. Names and any other answers are stored readable so the organizer can export them, until they are deleted. This is not a vault for sensitive information.
Your device matters. Malware or a shared computer can expose an open dashboard. Close the tab when you finish.

Found a vulnerability? Please report it responsibly using the contact on the Bidadari website.