The warning only shows up if the link is embedding in another platforms iframe. Perhaps the method people are using to load your QR code is wrapping the game URL in something else?
Thanks for the response; after some debugging it only happens if the link is from a Google Form so they are probably doing some weird embedding or something. So it looks like itch is not to blame here.
