Add noopener to target=_blank links for tabnabbing protection

9a6d017112f5f92f13110368f43249c4f07e823d · 2026-05-18 20:15:55 -0700 · SteveStudio2

Files touched

M public/builder.js
M src/views/portfolio.ejs

Diff

commit 9a6d017112f5f92f13110368f43249c4f07e823d
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Mon May 18 20:15:55 2026 -0700

    Add noopener to target=_blank links for tabnabbing protection
---
 public/builder.js       | 2 +-
 src/views/portfolio.ejs | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/public/builder.js b/public/builder.js
index b3da368..607c642 100644
--- a/public/builder.js
+++ b/public/builder.js
@@ -203,7 +203,7 @@ async function createPortfolio() {
     openLink.className = "btn";
     openLink.href = data.shareUrl;
     openLink.target = "_blank";
-    openLink.rel = "noreferrer";
+    openLink.rel = "noopener noreferrer";
     openLink.textContent = "Open Mood Board";
     actions.appendChild(openLink);
 
diff --git a/src/views/portfolio.ejs b/src/views/portfolio.ejs
index f42021d..b3261ce 100644
--- a/src/views/portfolio.ejs
+++ b/src/views/portfolio.ejs
@@ -180,7 +180,7 @@
           <% portfolio.patterns.forEach(function(p) { %>
             <div class="mood-item">
               <% if (p.productUrl) { %>
-                <a href="<%= p.productUrl %>" target="_blank" rel="noreferrer">
+                <a href="<%= p.productUrl %>" target="_blank" rel="noopener noreferrer">
                   <img src="<%= p.imageUrl %>" alt="<%= p.name %>" loading="lazy" />
                 </a>
               <% } else { %>
@@ -223,7 +223,7 @@
           <% if (portfolio.contact.website) { %>
           <div class="field">
             <dt>Website</dt>
-            <dd><a href="<%= portfolio.contact.website %>" target="_blank" rel="noreferrer"><%= portfolio.contact.website %></a></dd>
+            <dd><a href="<%= portfolio.contact.website %>" target="_blank" rel="noopener noreferrer"><%= portfolio.contact.website %></a></dd>
           </div>
           <% } %>
         </dl>

← b48c919 initial snapshot — gitify all builds (CLAUDE.md rule 2026-05 · back to Designer Portfolio Pages · Untrack local SQLite dev database from git 75e3178 →