Any URL can send you anywhere. If you trust the origin of the QR-code, there's no reason to not trust going to /qr. For the record, I agree with reviewing the

Any URL can send you anywhere. If you trust the origin of the QR-code, there's no reason to not trust going to /qr. For the record, I agree with reviewing the URL before hitting it, but if the domain matches what I expect, I'd be strongly inclined to trust the rest.