From d5296f82d7bf6a3ffe31ce237de35f8f6f0a7d1f Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 26 Feb 2026 17:33:00 +0000
Subject: [PATCH] Fix: Add rel="noopener noreferrer" to embed watch button

This commit mitigates a reverse tabnabbing vulnerability by ensuring
that the external link in the embed player opens with proper
security attributes.

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 embed.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/embed.html b/embed.html
index 3f20931d..eefea746 100644
--- a/embed.html
+++ b/embed.html
@@ -96,6 +96,7 @@
               id="embedWatchButton"
               href="#"
               target="_blank"
+              rel="noopener noreferrer"
               class="flex items-center gap-2 rounded-full border border-white/20 bg-white/10 px-3 py-1.5 text-xs font-medium text-white transition-colors hover:bg-white/20 backdrop-blur-md"
             >
               <span>Watch on</span>