Find QR codes and blur personal details in images

Link detection decodes QR codes and moderates what they say, and the redact transform blurs text or contact details in the images CalmLens delivers.

A screenshot or flyer can carry more than its picture. A QR code in the corner may point anywhere, and a photo of a receipt or a parcel label can show someone's phone number. Release 2026.3 adds two features for text inside images: the linkDetection processing feature, which decodes QR codes and lists the links an image contains, and the redact transform, which blurs text or personal information in the copies the CDN serves.

Decode QR codes with link detection

Link detection is off by default. Turn it on for an upload in processingOptions:

{
  "processingOptions": {
    "features": {
      "linkDetection": { "enabled": true }
    }
  }
}

CalmLens then decodes up to five QR codes in the image. What each code says is moderated as text and merged into the image's report, the same way OCR text is. A QR code that holds abusive text can therefore change the decision on an image that looks harmless.

The results are on the asset as classification.linkDetection:

{
  "status": "evaluated",
  "stage": "ga",
  "qrCodes": [
    {
      "value": "https://example.com/offer",
      "box": { "left": 0.62, "top": 0.71, "width": 0.18, "height": 0.18 }
    }
  ],
  "links": [{ "url": "https://example.com/offer", "source": "qr-code" }]
}

Each QR code has its contents and a box giving its position as fractions of the image width and height. links lists the web links found, without repeats. A link written without a scheme, such as example.com/offer, is listed with https:// added.

When OCR is also on, links includes the links in the extracted text, with source: "text". Without OCR, only links inside QR codes are listed.

CalmLens doesn't visit the links. They are listed so you can check them yourself, for example against a list of domains your community has seen used for scams, and decide what to do with the post.

Link detection itself is free. Moderating the text in a QR code is billed in text-moderation tokens, like OCR text.

Where OCR found text

When OCR is on for an upload (processingOptions.features.ocr.enabled: true), it now also records where the text sits, as classification.textRegions. There is a box for each paragraph, and a box around each piece of personal information OCR reads: email addresses, phone numbers, payment card numbers, IBANs and US social security numbers. Those boxes are marked personalInformation: true. Like QR code positions, the boxes are fractions of the image size, so they stay correct whatever size you display the image at.

Blur them with the redact transform

The redact transform uses those regions to blur parts of a rendered image:

• redact.personalInformation blurs only the personal information.
• redact.text blurs every paragraph of text.

Redaction runs before any other transform option, on the full image, so the boxes line up with what OCR saw. Add it to a rendered URL like any other step:

/assets/:projectId/:assetIdentifier/rendered/redact.personalInformation/width=800

That URL serves an 800-pixel-wide copy with contact details and account numbers blurred and the rest of the picture intact.

Put redaction in a lens

If every image in a feature should be served redacted, define a lens for it. Lenses also arrived in 2026.3: a lens is a named, versioned list of transforms that the CDN applies when it serves an asset. Put redact in the first step:

{
  "type": "imageTransform",
  "options": {
    "redact": { "personalInformation": true },
    "width": 800
  }
}

Later steps work on a resized or cropped image, so a redact placed after them would no longer match the regions OCR recorded.

What redaction doesn't cover

Redaction relies on what OCR found when the image was processed. An image uploaded without OCR has no text regions, and the transform serves it unchanged rather than failing. Text OCR couldn't read, such as small, blurred or heavily stylised lettering, has no region either, so it is not blurred.

The transform changes rendered copies only. The asset's original resource still returns the file as it was uploaded, since lenses and transforms don't apply to it. If the unredacted file must not reach viewers, keep the asset private and give browsers signed URLs for the redacted rendering. A signed URL covers the resource and the full lens and transform selector, so changing the URL to remove the redaction makes the signature check fail.

The OCR and image reports guide covers how extracted text and QR code text are merged into an image's report, and the lenses guide covers every transform option.