This is expected behavior . BeckerBox runs locally on your computer, so your phone cannot verify it the same way it verifies regular websites on the internet.
BeckerBox runs on your computer — right where you scanned the QR code.
Think of it like a neighbor handing you a note directly versus receiving a letter through the postal service — both can be trustworthy, but only one goes through an official process.
Modern browsers rely on HTTPS and trusted certificate authorities (CAs) to verify websites. These are globally recognized organizations that confirm a site's identity is legitimate.
A locally hosted server like BeckerBox does not have a certificate from a public CA. Your phone cannot verify its identity using the standard trust chain.
BeckerBox binds to a private IP (192.168.x.x or 10.x.x.x). Your phone connects directly to that address over the local network when you scan the QR code.
Traffic is unencrypted. Browsers flag this as "Not Secure" because there is no TLS layer protecting the connection.
The server presents a certificate during the handshake. For the browser to trust it, the cert must chain back to a trusted root CA in the device's trust store. BeckerBox uses a self-signed cert, which cannot be validated this way.
This is expected for locally hosted servers and internal tools operating within a private network without public domain verification.