From f5157aed65051074efa90a9bd789168eb907981c Mon Sep 17 00:00:00 2001
From: Beniamin Malinski <malinskibeniamin@gmail.com>
Date: Sat, 13 Jun 2026 19:22:17 +0200
Subject: [PATCH 1/2] fix(frontend): add rel=noopener noreferrer to
 target=_blank links

External links opened with target="_blank" but no rel exposed reverse-tabnabbing
(window.opener) and referrer leakage. Add rel="noopener noreferrer" to the custom
Link/UILink/router-link sites that biome's noBlankTarget rule (native <a> only)
can't reach. Vendor redpanda-ui components left untouched (audit SECURITY-03).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 frontend/src/components/pages/connect/overview.tsx        | 8 ++++++--
 frontend/src/components/pages/quotas/quotas-list.tsx      | 2 +-
 .../pages/rp-connect/onboarding/add-user-step.tsx         | 2 ++
 .../pages/rp-connect/onboarding/connect-tiles.tsx         | 2 +-
 .../src/components/pages/rp-connect/pipeline/list.tsx     | 4 ++--
 .../src/components/pages/rp-connect/pipelines-create.tsx  | 7 ++++---
 .../src/components/pages/rp-connect/pipelines-edit.tsx    | 6 +++---
 .../components/pages/transcripts/transcript-list-page.tsx | 2 +-
 8 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/frontend/src/components/pages/connect/overview.tsx b/frontend/src/components/pages/connect/overview.tsx
index dfaa7df02e..1b99d0d384 100644
--- a/frontend/src/components/pages/connect/overview.tsx
+++ b/frontend/src/components/pages/connect/overview.tsx
@@ -163,7 +163,7 @@ class KafkaConnectOverview extends PageComponent<{
               {this.props.isKafkaConnectEnabled
                 ? 'Redpanda Connect is an alternative to Kafka Connect. Choose from a growing ecosystem of readily available connectors.'
                 : 'Redpanda Connect is a data streaming service for building scalable, high-performance data pipelines that drive real-time analytics and actionable business insights. Integrate data across systems with hundreds of prebuilt connectors, change data capture (CDC) capabilities, and YAML-configurable pipelines.'}{' '}
-              <Link href="https://docs.redpanda.com/redpanda-connect/home/" target="_blank">
+              <Link href="https://docs.redpanda.com/redpanda-connect/home/" rel="noopener noreferrer" target="_blank">
                 Learn more
               </Link>
             </Text>
@@ -179,7 +179,11 @@ class KafkaConnectOverview extends PageComponent<{
             <Text>
               Kafka Connect is our set of managed connectors. These provide a way to integrate your Redpanda data with
               different data systems.{' '}
-              <Link href="https://docs.redpanda.com/redpanda-cloud/develop/managed-connectors/" target="_blank">
+              <Link
+                href="https://docs.redpanda.com/redpanda-cloud/develop/managed-connectors/"
+                rel="noopener noreferrer"
+                target="_blank"
+              >
                 Learn more.
               </Link>
             </Text>
diff --git a/frontend/src/components/pages/quotas/quotas-list.tsx b/frontend/src/components/pages/quotas/quotas-list.tsx
index fc01d61dbc..7f833dfa4f 100644
--- a/frontend/src/components/pages/quotas/quotas-list.tsx
+++ b/frontend/src/components/pages/quotas/quotas-list.tsx
@@ -107,7 +107,7 @@ const QuotasList = () => {
           <Section>
             <Result
               extra={
-                <Link href="https://docs.redpanda.com/docs/manage/console/" target="_blank">
+                <Link href="https://docs.redpanda.com/docs/manage/console/" rel="noopener noreferrer" target="_blank">
                   <Button variant="solid">Redpanda Console documentation for roles and permissions</Button>
                 </Link>
               }
diff --git a/frontend/src/components/pages/rp-connect/onboarding/add-user-step.tsx b/frontend/src/components/pages/rp-connect/onboarding/add-user-step.tsx
index 7e09f0a6e5..0687476253 100644
--- a/frontend/src/components/pages/rp-connect/onboarding/add-user-step.tsx
+++ b/frontend/src/components/pages/rp-connect/onboarding/add-user-step.tsx
@@ -545,6 +545,7 @@ export const AddUserStep = forwardRef<UserStepRef, AddUserStepProps & MotionProp
                             <TanStackRouterLink
                               className="text-blue-800"
                               params={{ userName: existingUserSelected.name }}
+                              rel="noopener noreferrer"
                               target="_blank"
                               to="/security/users/$userName/details"
                             >
@@ -693,6 +694,7 @@ export const AddUserStep = forwardRef<UserStepRef, AddUserStepProps & MotionProp
                                     <Text variant="small">
                                       You will need to configure{' '}
                                       <TanStackRouterLink
+                                        rel="noopener noreferrer"
                                         target="_blank"
                                         to={
                                           isFeatureFlagEnabled('enableNewSecurityPage')
diff --git a/frontend/src/components/pages/rp-connect/onboarding/connect-tiles.tsx b/frontend/src/components/pages/rp-connect/onboarding/connect-tiles.tsx
index 3ddbf7366a..ab77cc55bf 100644
--- a/frontend/src/components/pages/rp-connect/onboarding/connect-tiles.tsx
+++ b/frontend/src/components/pages/rp-connect/onboarding/connect-tiles.tsx
@@ -346,7 +346,7 @@ export const ConnectTiles = memo(
                     that drive real-time analytics and actionable business insights. Integrate data across systems with
                     hundreds of prebuilt connectors, change data capture (CDC) capabilities, and YAML-configurable
                     pipelines.{' '}
-                    <Link href="https://docs.redpanda.com/redpanda-connect/home/" target="_blank">
+                    <Link href="https://docs.redpanda.com/redpanda-connect/home/" rel="noopener noreferrer" target="_blank">
                       Learn more
                     </Link>
                   </Text>
diff --git a/frontend/src/components/pages/rp-connect/pipeline/list.tsx b/frontend/src/components/pages/rp-connect/pipeline/list.tsx
index e149474d21..79dd87a393 100644
--- a/frontend/src/components/pages/rp-connect/pipeline/list.tsx
+++ b/frontend/src/components/pages/rp-connect/pipeline/list.tsx
@@ -698,7 +698,7 @@ const RedpandaConnectContent = () => (
       Redpanda Connect is a data streaming service for building scalable, high-performance data pipelines that drive
       real-time analytics and actionable business insights. Integrate data across systems with hundreds of prebuilt
       connectors, change data capture (CDC) capabilities, and YAML-configurable pipelines.{' '}
-      <Link href="https://docs.redpanda.com/redpanda-connect/home/" target="_blank">
+      <Link href="https://docs.redpanda.com/redpanda-connect/home/" rel="noopener noreferrer" target="_blank">
         Learn more
       </Link>
     </Text>
@@ -750,7 +750,7 @@ export const PipelineListPage = () => {
               <Text>
                 Kafka Connect is our set of managed connectors. These provide a way to integrate your Redpanda data with
                 different data systems.{' '}
-                <Link href="https://docs.redpanda.com/redpanda-cloud/develop/managed-connectors/" target="_blank">
+                <Link href="https://docs.redpanda.com/redpanda-cloud/develop/managed-connectors/" rel="noopener noreferrer" target="_blank">
                   Learn more
                 </Link>
               </Text>
diff --git a/frontend/src/components/pages/rp-connect/pipelines-create.tsx b/frontend/src/components/pages/rp-connect/pipelines-create.tsx
index 5a22ff075e..503c9a7df3 100644
--- a/frontend/src/components/pages/rp-connect/pipelines-create.tsx
+++ b/frontend/src/components/pages/rp-connect/pipelines-create.tsx
@@ -131,15 +131,15 @@ const RpConnectPipelinesCreateContent = () => {
       <div className="my-2">
         <UIText>
           For help creating your pipeline, see our{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/connect-quickstart/" target="_blank">
+          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/connect-quickstart/" rel="noopener noreferrer" target="_blank">
             quickstart
           </UILink>
           ,{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/cookbooks/" target="_blank">
+          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/cookbooks/" rel="noopener noreferrer" target="_blank">
             library of examples
           </UILink>
           , and{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/components/catalog/" target="_blank">
+          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/components/catalog/" rel="noopener noreferrer" target="_blank">
             connector catalog
           </UILink>
           .
@@ -453,6 +453,7 @@ export const PipelineEditor = (p: {
                       This looks like a Kafka Connect configuration. For help with Redpanda Connect configurations,{' '}
                       <UILink
                         href="https://docs.redpanda.com/redpanda-cloud/develop/connect/connect-quickstart/"
+                        rel="noopener noreferrer"
                         target="_blank"
                       >
                         see our quickstart documentation
diff --git a/frontend/src/components/pages/rp-connect/pipelines-edit.tsx b/frontend/src/components/pages/rp-connect/pipelines-edit.tsx
index ac7fea147e..6c035dccb3 100644
--- a/frontend/src/components/pages/rp-connect/pipelines-edit.tsx
+++ b/frontend/src/components/pages/rp-connect/pipelines-edit.tsx
@@ -147,15 +147,15 @@ const RpConnectPipelinesEditContent = ({ pipeline, pipelineId }: { pipeline: Pip
       <div className="my-2">
         <UIText>
           For help editing your pipeline, see our{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/connect-quickstart/" target="_blank">
+          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/connect-quickstart/" rel="noopener noreferrer" target="_blank">
             quickstart documentation
           </UILink>
           , our{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/cookbooks/" target="_blank">
+          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/cookbooks/" rel="noopener noreferrer" target="_blank">
             library of examples
           </UILink>
           , or our{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/components/catalog/" target="_blank">
+          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/components/catalog/" rel="noopener noreferrer" target="_blank">
             connector catalog
           </UILink>
           .
diff --git a/frontend/src/components/pages/transcripts/transcript-list-page.tsx b/frontend/src/components/pages/transcripts/transcript-list-page.tsx
index 640d254720..d0ba6639b2 100644
--- a/frontend/src/components/pages/transcripts/transcript-list-page.tsx
+++ b/frontend/src/components/pages/transcripts/transcript-list-page.tsx
@@ -768,7 +768,7 @@ export const TranscriptListPage: FC<TranscriptListPageProps> = ({ disableFacetin
         <Text variant="muted">
           Trace and debug AI requests across your agentic dataplane — view LLM calls, tool invocations, and spans from
           agents, gateways, and services.{' '}
-          <Link href="https://docs.redpanda.com/redpanda-cloud/ai-agents/observability" target="_blank">
+          <Link href="https://docs.redpanda.com/redpanda-cloud/ai-agents/observability" rel="noopener noreferrer" target="_blank">
             Learn more
           </Link>
         </Text>

From ba4100d3fe2dd765c7f9210706ac28e4b7052205 Mon Sep 17 00:00:00 2001
From: Beniamin Malinski <malinskibeniamin@gmail.com>
Date: Sat, 13 Jun 2026 19:31:10 +0200
Subject: [PATCH 2/2] style(frontend): wrap long external-link tags to satisfy
 formatter

biome's formatter wraps the Link/UILink tags that exceeded line width after the
rel="noopener noreferrer" addition. No semantic change (CI 'bun run lint' output).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../rp-connect/onboarding/connect-tiles.tsx    |  6 +++++-
 .../pages/rp-connect/pipeline/list.tsx         |  6 +++++-
 .../pages/rp-connect/pipelines-create.tsx      | 18 +++++++++++++++---
 .../pages/rp-connect/pipelines-edit.tsx        | 18 +++++++++++++++---
 .../pages/transcripts/transcript-list-page.tsx |  6 +++++-
 5 files changed, 45 insertions(+), 9 deletions(-)

diff --git a/frontend/src/components/pages/rp-connect/onboarding/connect-tiles.tsx b/frontend/src/components/pages/rp-connect/onboarding/connect-tiles.tsx
index ab77cc55bf..60a4f8150e 100644
--- a/frontend/src/components/pages/rp-connect/onboarding/connect-tiles.tsx
+++ b/frontend/src/components/pages/rp-connect/onboarding/connect-tiles.tsx
@@ -346,7 +346,11 @@ export const ConnectTiles = memo(
                     that drive real-time analytics and actionable business insights. Integrate data across systems with
                     hundreds of prebuilt connectors, change data capture (CDC) capabilities, and YAML-configurable
                     pipelines.{' '}
-                    <Link href="https://docs.redpanda.com/redpanda-connect/home/" rel="noopener noreferrer" target="_blank">
+                    <Link
+                      href="https://docs.redpanda.com/redpanda-connect/home/"
+                      rel="noopener noreferrer"
+                      target="_blank"
+                    >
                       Learn more
                     </Link>
                   </Text>
diff --git a/frontend/src/components/pages/rp-connect/pipeline/list.tsx b/frontend/src/components/pages/rp-connect/pipeline/list.tsx
index 79dd87a393..2a03f6eadb 100644
--- a/frontend/src/components/pages/rp-connect/pipeline/list.tsx
+++ b/frontend/src/components/pages/rp-connect/pipeline/list.tsx
@@ -750,7 +750,11 @@ export const PipelineListPage = () => {
               <Text>
                 Kafka Connect is our set of managed connectors. These provide a way to integrate your Redpanda data with
                 different data systems.{' '}
-                <Link href="https://docs.redpanda.com/redpanda-cloud/develop/managed-connectors/" rel="noopener noreferrer" target="_blank">
+                <Link
+                  href="https://docs.redpanda.com/redpanda-cloud/develop/managed-connectors/"
+                  rel="noopener noreferrer"
+                  target="_blank"
+                >
                   Learn more
                 </Link>
               </Text>
diff --git a/frontend/src/components/pages/rp-connect/pipelines-create.tsx b/frontend/src/components/pages/rp-connect/pipelines-create.tsx
index 503c9a7df3..540e7a5a61 100644
--- a/frontend/src/components/pages/rp-connect/pipelines-create.tsx
+++ b/frontend/src/components/pages/rp-connect/pipelines-create.tsx
@@ -131,15 +131,27 @@ const RpConnectPipelinesCreateContent = () => {
       <div className="my-2">
         <UIText>
           For help creating your pipeline, see our{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/connect-quickstart/" rel="noopener noreferrer" target="_blank">
+          <UILink
+            href="https://docs.redpanda.com/redpanda-cloud/develop/connect/connect-quickstart/"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
             quickstart
           </UILink>
           ,{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/cookbooks/" rel="noopener noreferrer" target="_blank">
+          <UILink
+            href="https://docs.redpanda.com/redpanda-cloud/develop/connect/cookbooks/"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
             library of examples
           </UILink>
           , and{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/components/catalog/" rel="noopener noreferrer" target="_blank">
+          <UILink
+            href="https://docs.redpanda.com/redpanda-cloud/develop/connect/components/catalog/"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
             connector catalog
           </UILink>
           .
diff --git a/frontend/src/components/pages/rp-connect/pipelines-edit.tsx b/frontend/src/components/pages/rp-connect/pipelines-edit.tsx
index 6c035dccb3..a002e344b7 100644
--- a/frontend/src/components/pages/rp-connect/pipelines-edit.tsx
+++ b/frontend/src/components/pages/rp-connect/pipelines-edit.tsx
@@ -147,15 +147,27 @@ const RpConnectPipelinesEditContent = ({ pipeline, pipelineId }: { pipeline: Pip
       <div className="my-2">
         <UIText>
           For help editing your pipeline, see our{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/connect-quickstart/" rel="noopener noreferrer" target="_blank">
+          <UILink
+            href="https://docs.redpanda.com/redpanda-cloud/develop/connect/connect-quickstart/"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
             quickstart documentation
           </UILink>
           , our{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/cookbooks/" rel="noopener noreferrer" target="_blank">
+          <UILink
+            href="https://docs.redpanda.com/redpanda-cloud/develop/connect/cookbooks/"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
             library of examples
           </UILink>
           , or our{' '}
-          <UILink href="https://docs.redpanda.com/redpanda-cloud/develop/connect/components/catalog/" rel="noopener noreferrer" target="_blank">
+          <UILink
+            href="https://docs.redpanda.com/redpanda-cloud/develop/connect/components/catalog/"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
             connector catalog
           </UILink>
           .
diff --git a/frontend/src/components/pages/transcripts/transcript-list-page.tsx b/frontend/src/components/pages/transcripts/transcript-list-page.tsx
index d0ba6639b2..f22e3bc417 100644
--- a/frontend/src/components/pages/transcripts/transcript-list-page.tsx
+++ b/frontend/src/components/pages/transcripts/transcript-list-page.tsx
@@ -768,7 +768,11 @@ export const TranscriptListPage: FC<TranscriptListPageProps> = ({ disableFacetin
         <Text variant="muted">
           Trace and debug AI requests across your agentic dataplane — view LLM calls, tool invocations, and spans from
           agents, gateways, and services.{' '}
-          <Link href="https://docs.redpanda.com/redpanda-cloud/ai-agents/observability" rel="noopener noreferrer" target="_blank">
+          <Link
+            href="https://docs.redpanda.com/redpanda-cloud/ai-agents/observability"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
             Learn more
           </Link>
         </Text>