Will It Vibe?target="_blank" without rel="noopener"
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
An anchor that opens in a new tab with target="_blank" but no rel gives the opened page access to window.opener, enabling reverse tabnabbing (the new page can navigate your tab to a phishing site).
Why it matters
An anchor with target="_blank" but no rel="noopener" lets the newly opened page read window.opener and navigate your original tab somewhere else, which is used for phishing (reverse tabnabbing). Older browsers do not set noopener automatically, so the protection has to be explicit.
How to fix it
Add rel="noopener noreferrer" to every anchor that uses target="_blank". noopener severs the window.opener link and noreferrer also withholds the referrer. If you open windows programmatically with window.open, pass "noopener" in the features argument.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo