From 2b4e93894a90ecba98cd64389d417a4531d10dbd Mon Sep 17 00:00:00 2001
From: RonniSkansing <rskansing@gmail.com>
Date: Mon, 10 Aug 2026 20:02:06 +0200
Subject: [PATCH] fix referrer leak in outgoing links

Signed-off-by: RonniSkansing <rskansing@gmail.com>
---
 frontend/src/lib/components/modal/CommandPalette.svelte | 2 +-
 frontend/src/routes/install/+page.svelte                | 3 ++-
 frontend/src/routes/settings/panels/General.svelte      | 3 ++-
 frontend/src/routes/settings/panels/Reports.svelte      | 1 +
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/modal/CommandPalette.svelte b/frontend/src/lib/components/modal/CommandPalette.svelte
index 64d6a6c..ee6ffbf 100644
--- a/frontend/src/lib/components/modal/CommandPalette.svelte
+++ b/frontend/src/lib/components/modal/CommandPalette.svelte
@@ -211,7 +211,7 @@
 			toggleChangeCompanyModal();
 			close();
 		} else if (item.external && item.url) {
-			window.open(item.url, '_blank');
+			window.open(item.url, '_blank', 'noopener,noreferrer');
 			close();
 		}
 	};
diff --git a/frontend/src/routes/install/+page.svelte b/frontend/src/routes/install/+page.svelte
index f1420b8..0f6b223 100644
--- a/frontend/src/routes/install/+page.svelte
+++ b/frontend/src/routes/install/+page.svelte
@@ -349,7 +349,8 @@
 												<a
 													class="white underline"
 													href="https://phishing.club/blog/phishing-simulation-vs-red-team-phishing/"
-													target="_blank">phishing simulation and red team phishing</a
+													target="_blank"
+													rel="noopener noreferrer">phishing simulation and red team phishing</a
 												>
 											</p>
 										</div>
diff --git a/frontend/src/routes/settings/panels/General.svelte b/frontend/src/routes/settings/panels/General.svelte
index 1a2f8f7..4f8eae1 100644
--- a/frontend/src/routes/settings/panels/General.svelte
+++ b/frontend/src/routes/settings/panels/General.svelte
@@ -131,7 +131,8 @@
 					Read about the difference between <a
 						class="white underline"
 						href="https://phishing.club/blog/phishing-simulation-vs-red-team-phishing/"
-						target="_blank">phishing simulation and red team phishing</a
+						target="_blank"
+						rel="noopener noreferrer">phishing simulation and red team phishing</a
 					>
 				</p>
 			</div>
diff --git a/frontend/src/routes/settings/panels/Reports.svelte b/frontend/src/routes/settings/panels/Reports.svelte
index acf1170..87326db 100644
--- a/frontend/src/routes/settings/panels/Reports.svelte
+++ b/frontend/src/routes/settings/panels/Reports.svelte
@@ -247,6 +247,7 @@
 				See <a
 					href="https://phishing.club/guide/settings/#pdf-reports"
 					target="_blank"
+					rel="noopener noreferrer"
 					class="underline">the setup guide</a
 				> for dependency installation and AppArmor configuration.
 			</p>