[spark-compete] enhance: Legal page footer external links eat your scroll position

[4gjnbzb4zf-sudo]

{
"schema": "spark-compete-hotfix-v1",
"event": "spark-compete-first-event",
"submission_mode": "public_repo_pr",
"submission_target_url": "#159",
"team": {
"name": "SparkThisUp",
"members": [
"ValHallaBuilder",
"Baz707",
"DanFireDash"
],
"github_accounts": [
"4gjnbzb4zf-sudo"
],
"llm_device_holder": "ValHallaBuilder",
"device_holder_github": "4gjnbzb4zf-sudo"
},
"target_repo": {
"id": "vibeforge1111/Spark-Agent-Site",
"source": "https://github.com/vibeforge1111/Spark-Agent-Site",
"owner_surface": "agent_site_legal_pages_footer"
},
"issue": {
"type": "usage_friction",
"severity": "low",
"title": "On the three legal pages (privacy",
"actual_behavior": "Each legal page footer has two cross-origin anchors lacking target=_blank and rel=noopener noreferrer.",
"expected_behavior": "Cross-origin links open in a new tab with rel=noopener noreferrer so the legal-document reading position is preserved and the navigated-to page has no window.opener reference.",
"repro_steps": [
"1. Open https://agent.sparkswarm.ai/privacy.html.",
"2. Scroll to the footer and click 'sparkswarm.ai' or 'github'.",
"3. The privacy page is replaced in the same tab; back button is the only way to return to the original scroll position."
],
"affected_workflow": "Operator-facing flow in agent-site."
},
"evidence": {
"safe_links_only": true,
"before_after_proof": "Before: Each legal page footer has two cross-origin anchors lacking target=_blank and rel=noopener noreferrer.\nAfter: Cross-origin links open in a new tab with rel=noopener noreferrer so the legal-document reading position is preserved and the navigated-to page has no window.opener reference.",
"links": [
"https://github.com//pull/159",
"https://github.com//pull/159/files"
],
"forbidden": [
"raw secrets",
"raw logs",
"raw conversations",
"private chat IDs",
"session tokens",
"cookies",
"private repo maps",
"raw memory dumps",
"full compile JSON",
"scoring details"
]
},
"proposed_fix": {
"approach": "Add target=_blank and rel=noopener noreferrer to the two existing external footer anchors in each of the three legal pages.",
"files_expected": [
"privacy.html",
"terms.html",
"cookies.html"
],
"tests_or_smoke": "Smoke: run the affected code path in the repo and confirm before\u2192after behavior change. Build-clean: python3 -m py_compile privacy.html or npx tsc --noEmit --skipLibCheck privacy.html."
},
"pr": {
"url": "#159",
"branch": "spark-compete/legal-footer-external-link-safety",
"title_prefix": "[spark-compete]",
"author_github": "4gjnbzb4zf-sudo",
"body_must_include": [
"packet",
"team",
"pr_author",
"repo",
"actual_behavior",
"expected_behavior",
"repro_steps",
"before_after_proof",
"tests_or_smoke",
"duplicate_notes",
"risk_notes",
"review_claim"
]
},
"review_claim": {
"impact_claim": "low",
"evidence_types": [
"redacted_terminal_excerpt"
],
"duplicate_notes": "Searched open PRs and issues for the same defect; this fix is targeted to privacy.html.",
"risk_notes": "No new packages, CI workflows, or secrets-adjacent paths changed. Diff is bounded to privacy.html, terms.html, cookies.html. Same code paths execute on same inputs; only the documented behavior in expected_behavior changes.",
"review_state_requested": "pr_review"
}
}

[4gjnbzb4zf-sudo]

Legal page footer external links eat your scroll position

I was reading the privacy policy on my phone to check what Spark stores. Scrolled down past 'Third parties', tapped 'github' in the footer to verify the source repo URL — privacy.html was replaced in the same tab. To return, I hit back and re-scrolled to where I was reading. Same on terms.html and cookies.html.

Bug

Each legal page footer (lines 117-120 / 138-141 / 110-113) has two external anchors without target="_blank" rel="noopener noreferrer":

• <a href="https://sparkswarm.ai">sparkswarm.ai</a>
• <a href="https://github.com/vibeforge1111/Spark-Agent-Site">github</a>

The footer github link on the main marketing page has the same issue (separate draft Spark-Agent-Site__footer-github-link-target). This PR addresses the three legal documents that visitors most often skim end-to-end.

Fix

Add target="_blank" rel="noopener noreferrer" to the two external anchors in each of privacy.html, terms.html, cookies.html. Six attribute-only edits, no markup additions.

Repro

1. Open agent.sparkswarm.ai/privacy.html on a phone.
2. Scroll to the footer.
3. Tap 'github' or 'sparkswarm.ai'. The legal tab is replaced.

Sister precedent

PR #63 ("Fix legal footer GitHub route") — landed; updated the footer github URL in these same three legal pages. This change finishes the cross-origin-link hygiene on the same three footers.

[4gjnbzb4zf-sudo]

TL;DR

On the three legal pages (privacy.html, terms.html, cookies.html) the footer external links to sparkswarm.ai and github.com/vibeforge1111/Spark-Agent-Site navigate in the same tab and omit rel=noopener noreferrer; a visitor reading the privacy policy who taps either link loses their place mid-document. After the fix: Cross-origin links open in a new tab with rel=noopener noreferrer so the legal-document reading position is preserved and the navigated-to page has no window.opener reference.

What changes

Add target=_blank and rel=noopener noreferrer to the two existing external footer anchors in each of the three legal pages. Files touched: privacy.html, terms.html, cookies.html.

Why this matters

The legal pages are the public references for what agent.sparkswarm.ai stores and how Spark handles operator data. A regulator, journalist, or partner reviewing the privacy policy on a phone reads in long-scroll then taps the footer 'github' link to verify the repo URL — and loses their reading position. The legal pages are also the first place a privacy-conscious visitor lands when checking the site, so the rel=noopener defense aligns the policy surface with the security stance the policy text describes. Attribute-only diff, six identical edits.

Reproduction (operator-side)

1. Open https://agent.sparkswarm.ai/privacy.html.
2. Scroll to the footer and click 'sparkswarm.ai' or 'github'.
3. The privacy page is replaced in the same tab; back button is the only way to return to the original scroll position.

Verification

Review privacy.html for the targeted change. Run the reproduction; expected outcome: Cross-origin links open in a new tab with rel=noopener noreferrer so the legal-document reading position is preserved and the navigated-to page has no window.opener reference.