json-schema-org / json-schema-org/website
[🐛 Bug]: missing rel="noopener noreferrer" on external links
@kunalverma2512 is already working on this.
Since Aug 30, 2026.
- Dominant language
- HTML
- Stars
- 169
- Forks
- 484
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 6
Description
Describe the bug
I was looking through the codebase and found 14 instances where external links open in a new tab but are missing the rel="noopener noreferrer" attribute
While modern browsers thankfully apply noopener protections automatically by default now it is still an industry standard defense-in-depth practice to explicitly include them
Relying entirely on browser defaults leaves users on older browsers vulnerable to tabnabbing and failing to explicitly set noreferrer means we are still leaking referrer data unnecessarily to external sites
Explicitly adding them also ensures our automated code quality and security scans remain perfectly clean
It looks like these slipped through our tooling for two reasons
First in the keywords index page a Nextjs Link component is missing it because ESLint usually only checks standard HTML anchor tags by default
Second in the first fundamentals blog post and the readme a few raw HTML tags were used instead of markdown links so they bypassed the StyledMarkdownBlock component which normally injects the rel attributes automatically
Steps To Reproduce
- search the codebase for target="_blank"
- look at pages/understanding-json-schema/keywords/index.page.tsx around line 66
- look at the raw HTML anchor tags in pages/blog/posts/applicability-json-schema-fundamentals-part-1.md
- see that the rel attribute is completely missing in these spots
Expected Behavior
Any external link configured to open in a new tab should explicitly include rel="noopener noreferrer" to ensure defense-in-depth security for legacy browsers prevent referrer leakage and keep our code quality checks completely clean
Screenshots
Device Information [optional]
- OS: macOS
- Browser: Chrome
- version: 152.0.7977.64
Are you working on this issue?
Yes
Do you think this work might require an [Architectural Decision Record (ADR)]? (significant or noteworthy)
No
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.