Only ever encode a receiving address
A receiving address is public by design: it lets people send to you and can never be used to withdraw. A private key or seed phrase is the opposite, and a QR code is a perfectly readable way to hand one to anybody who photographs it. Never put a key, a seed phrase or an exchange login into a code, whatever a support message or a helpful stranger tells you.