I've just test the plugin on students and noticed that in Moodle mobile app users can always submit a password even if you haven't scanned the QR code. Where as in mobile browser it will display "QR password is wrong or has expired" if not scanned. Meaning students can pass on the password to fellow students who are absent and still mark attendance via Moodle app with the same password.
How to avoid that? Why is the password prompt which is predefined and same to all even necessary?