diff --git a/AGENTS.md b/AGENTS.md
index 9f2d329a58..28af8bee96 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -179,6 +179,7 @@ src/
 - ESLint enforced: `neostandard` + `pluginVue.configs['flat/vue2-recommended']` + `pluginRegexp` + `@vue/eslint-config-typescript`
 - `.editorconfig` rules: 2 spaces, LF line endings, UTF-8, trim trailing whitespace, max line 100 (code)
 - camelCase for variables/methods, PascalCase for components
+- Any link opening a new tab (`target="_blank"`) **must** also set `rel="noopener noreferrer"` — applies to `<a>`, `<v-btn>`/`<app-btn>` with `:href`, and any HTML strings rendered via `v-safe-html` (e.g. `src/util/link-external-urls.ts`)
 - Use `consola` for logging, not `console.log` (configured in `src/setupConsola.ts` — warn in prod, verbose in dev)
 - Type imports: `import type { ... }` for types only (`verbatimModuleSyntax: true`)
 - `satisfies` keyword for store module type checking
diff --git a/src/components/common/Login.vue b/src/components/common/Login.vue
index 31e81e8fba..83cad6d37c 100644
--- a/src/components/common/Login.vue
+++ b/src/components/common/Login.vue
@@ -84,6 +84,7 @@
               class="custom-transform-class text-none"
               :href="$globals.DOCS_AUTH_LOST_PASSWORD"
               target="_blank"
+              rel="noopener noreferrer"
             >
               {{ $t('app.general.btn.forgot_password') }}
             </app-btn>
@@ -93,6 +94,7 @@
               class="custom-transform-class text-none"
               :href="$globals.DOCS_AUTH"
               target="_blank"
+              rel="noopener noreferrer"
             >
               {{ $t('app.general.btn.auth_unsure') }}
             </app-btn>
diff --git a/src/components/layout/AppNotificationMenu.vue b/src/components/layout/AppNotificationMenu.vue
index a1544e5f20..3ce4b3b5b0 100644
--- a/src/components/layout/AppNotificationMenu.vue
+++ b/src/components/layout/AppNotificationMenu.vue
@@ -109,6 +109,7 @@
                   x-small
                   :href="n.to"
                   target="_blank"
+                  rel="noopener noreferrer"
                   class="mr-1"
                   @click="menu = false"
                 />
diff --git a/src/components/settings/VersionInformationDialog.vue b/src/components/settings/VersionInformationDialog.vue
index 40cc229bec..4db93c05be 100644
--- a/src/components/settings/VersionInformationDialog.vue
+++ b/src/components/settings/VersionInformationDialog.vue
@@ -48,6 +48,7 @@
                       class="secondary--text"
                       :href="`${baseUrl}/commits/${component.branch}`"
                       target="_blank"
+                      rel="noopener noreferrer"
                     >
                       <strong>{{ commit.author }}</strong>
                     </a>
@@ -71,6 +72,7 @@
                     color="secondary"
                     :href="`${baseUrl}/commit/${commit.sha}`"
                     target="_blank"
+                    rel="noopener noreferrer"
                   >
                     <span class="primary--text">{{ commit.sha.substring(0, 7) }}</span>
                   </app-btn>
diff --git a/src/components/settings/VersionSettings.vue b/src/components/settings/VersionSettings.vue
index e341ac575f..913cb72a00 100644
--- a/src/components/settings/VersionSettings.vue
+++ b/src/components/settings/VersionSettings.vue
@@ -68,6 +68,7 @@
                   v-bind="attrs"
                   :href="component.remote_url"
                   target="_blank"
+                  rel="noopener noreferrer"
                   v-on="on"
                 >
                   <v-icon
diff --git a/src/components/widgets/afc/dialogs/AfcSettingsDialog.vue b/src/components/widgets/afc/dialogs/AfcSettingsDialog.vue
index df0d7068a1..c018cd9c51 100644
--- a/src/components/widgets/afc/dialogs/AfcSettingsDialog.vue
+++ b/src/components/widgets/afc/dialogs/AfcSettingsDialog.vue
@@ -12,6 +12,7 @@
         tile
         href="https://www.armoredturtle.xyz/docs/afc-klipper-add-on/toolhead/calculation.html"
         target="_blank"
+        rel="noopener noreferrer"
         class="me-1"
       >
         <v-icon left>
diff --git a/src/components/widgets/camera/CameraItem.vue b/src/components/widgets/camera/CameraItem.vue
index 8bab1df6c8..987a01a463 100644
--- a/src/components/widgets/camera/CameraItem.vue
+++ b/src/components/widgets/camera/CameraItem.vue
@@ -103,6 +103,7 @@
       <a
         :href="rawCameraUrl"
         target="_blank"
+        rel="noopener noreferrer"
       >
         <v-icon>$openInNew</v-icon>
       </a>
diff --git a/src/components/widgets/filesystem/FileEditorDialog.vue b/src/components/widgets/filesystem/FileEditorDialog.vue
index 4fb83be992..7bb721ac86 100644
--- a/src/components/widgets/filesystem/FileEditorDialog.vue
+++ b/src/components/widgets/filesystem/FileEditorDialog.vue
@@ -76,6 +76,7 @@
             v-if="!printerPrinting && configMap?.link"
             :href="configMap.link"
             target="_blank"
+            rel="noopener noreferrer"
           >
             <v-icon
               small
diff --git a/src/components/widgets/filesystem/FilePreviewDialog.vue b/src/components/widgets/filesystem/FilePreviewDialog.vue
index 8997cf4bde..44aaaeeeeb 100644
--- a/src/components/widgets/filesystem/FilePreviewDialog.vue
+++ b/src/components/widgets/filesystem/FilePreviewDialog.vue
@@ -145,7 +145,7 @@ export default class FilePreviewDialog extends Mixins(StateMixin) {
         link (args: Tokens.Link) {
           const html = this.constructor.prototype.link.call(this, args)
 
-          return html.replace(/^<a /, '<a target="_blank" ')
+          return html.replace(/^<a /, '<a target="_blank" rel="noopener noreferrer" ')
         }
       }
     }
diff --git a/src/components/widgets/spoolman/SpoolSelectionDialog.vue b/src/components/widgets/spoolman/SpoolSelectionDialog.vue
index bb7001be06..f29bcce8de 100644
--- a/src/components/widgets/spoolman/SpoolSelectionDialog.vue
+++ b/src/components/widgets/spoolman/SpoolSelectionDialog.vue
@@ -269,6 +269,7 @@
         v-if="spoolmanURL"
         :href="spoolmanURL"
         target="_blank"
+        rel="noopener noreferrer"
         color="primary"
         text
         type="button"