I don't think they thought beyond the requirement of "scanning a barcode and submitting a query based on the contents of the barcode". The barcode probably re

I don't think they thought beyond the requirement of "scanning a barcode and submitting a query based on the contents of the barcode". The barcode probably returns a userid or something else that's guessable or iterable.