Zippy, the lightning-bolt mascotZIPPY BLOG
← all posts
The Zippy Team

Your Logo, In The Middle Of Your QR Code — Not Ours

Custom QR codes have shipped since day one, with one embarrassing detail: the logo in the middle was the Zippy bolt. You can now upload your own. Also, why we refuse SVG uploads and always will.

qr codesbrandingcreatorssecurityproduct
Zippy the limbless lightning-bolt mascot beside a custom QR code whose centre is an empty frame slot with an upload arrow pointing into it, ready for your own logo instead of a bolt
Zippy, the lightning-bolt mascot

⚡ Zippy: you paid for a custom QR code and got my face in the middle of it. yeah. fair.

The bug that was technically a feature

Zippy's QR customizer has shipped brand colours, a "Scan me" frame, and a logo in the centre for a while now. The logo was a checkbox: on, or off.

On meant the Zippy bolt.

So a creator on a paid plan, customizing a code to print on merch, on a poster, on the back of a business card, could pick their colours — and then stamp our logo in the middle of it. That's not a customization feature. That's us using our customers' packaging as ad space and charging them $19 a month for the privilege.

Upload your own

In the QR dialog, tick the logo option and hit Upload your logo. It saves on your workspace, so you do it once and every QR you generate afterwards wears your mark instead of ours. Use the bolt puts ours back if you want it.

The code still scans. When there's a logo in the middle we bump the QR to the highest error-correction level, which is exactly what that level is for — enough redundancy that a chunk of the code can be covered and a camera still reads it.

Requires Hero, like the rest of QR customization. Removing a logo doesn't require anything, on any plan — we gate using a feature, never undoing it.

Why we won't accept an SVG

Here's the part worth reading even if you don't care about QR codes.

The natural thing to upload for a logo is an SVG. It's a logo file. Every brand kit has one. And we refuse them.

An SVG is not a picture. It's markup — a little document, in the same family as HTML, that can contain <script> tags, event handlers, and references to other files. A QR code from Zippy is also SVG: we generate it as vector so it stays sharp when you print it a metre wide.

Which means "accept an SVG logo" would really mean: take a document a stranger uploaded, paste it inside a document we generate, and then render that in a creator's dashboard. That is a textbook injection hole. Whoever uploaded the logo gets to run code in the browser of everyone who looks at that QR code.

We already close this hole for the QR's caption — the "SCAN ME" text is escaped on the way in, because it's user-supplied text landing inside our SVG. An uploaded logo is the same class of problem with a bigger payload, so it gets the same treatment, only stricter:

  • PNG, JPEG or WebP only, checked against an allow-list rather than a block-list. New file types are rejected by default instead of accidentally permitted.
  • Under 48 KB, measured on the decoded image, not the upload string.
  • The image is encoded into the QR file itself, never fetched from a URL. This is also why a printed Zippy QR keeps working with no internet — and why nobody scanning your poster quietly makes a request to a server you don't control.

If it doesn't match exactly what we allow, it doesn't get "cleaned up" and let through. It's refused, you're told why, and the QR falls back to the bolt rather than failing to render. A sanitised attack is still an attack that got halfway in.

Practical version: export your logo as a PNG with a transparent background. At the size a QR logo renders it will look identical to the SVG, and nothing about your code will ever be a security incident.

Read more