QR codes lead to public URLs that contain an enumerable report ID field, making it possible for an attacker to scrape all COVID-19 test reports for virtually any passenger.