json-schema-org / json-schema-org/website

[🐛 Bug]: missing rel="noopener noreferrer" on external links

Open
#2,465 0 comments 0 reactions 1 assignee View on GitHub

@kunalverma2512 is already working on this.

Since Aug 30, 2026.

🐛 Bug Status: Triage
Dominant language
HTML
Stars
169
Forks
484
Avg merge
2d 2h
Merged PRs (30d)
6

Description

Describe the bug

I was looking through the codebase and found 14 instances where external links open in a new tab but are missing the rel="noopener noreferrer" attribute

While modern browsers thankfully apply noopener protections automatically by default now it is still an industry standard defense-in-depth practice to explicitly include them
Relying entirely on browser defaults leaves users on older browsers vulnerable to tabnabbing and failing to explicitly set noreferrer means we are still leaking referrer data unnecessarily to external sites
Explicitly adding them also ensures our automated code quality and security scans remain perfectly clean

It looks like these slipped through our tooling for two reasons
First in the keywords index page a Nextjs Link component is missing it because ESLint usually only checks standard HTML anchor tags by default
Second in the first fundamentals blog post and the readme a few raw HTML tags were used instead of markdown links so they bypassed the StyledMarkdownBlock component which normally injects the rel attributes automatically

Steps To Reproduce
  1. search the codebase for target="_blank"
  2. look at pages/understanding-json-schema/keywords/index.page.tsx around line 66
  3. look at the raw HTML anchor tags in pages/blog/posts/applicability-json-schema-fundamentals-part-1.md
  4. see that the rel attribute is completely missing in these spots
Expected Behavior

Any external link configured to open in a new tab should explicitly include rel="noopener noreferrer" to ensure defense-in-depth security for legacy browsers prevent referrer leakage and keep our code quality checks completely clean

Screenshots
Image Image Image Image Image Image Image
Device Information [optional]
- OS: macOS
- Browser: Chrome
- version: 152.0.7977.64
Are you working on this issue?

Yes

Do you think this work might require an [Architectural Decision Record (ADR)]? (significant or noteworthy)

No

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.