AI & Agent Dev Bug Sandbox logo
AI & Agent Dev Bug SandboxBack to Radar

Footer Social Links Open In Same Tab Instead Of New Tab

On supabase.com, footer social media links (X, GitHub, Discord, YouTube, TikTok, Instagram) navigate away from the site in the same browser tab instead of opening in a new tab, causing user friction and a potential minor security concern due to lost session context.

mediumConfidence 95%Nextjs

Origin Analysis

Footer social link anchor tags are missing the target="_blank" attribute, so the browser's default same-tab navigation is used. The underlying design flaw is that external links from a website footer should explicitly specify target="_blank" to preserve the user's current session and browsing context.
1. Open https://supabase.com 2. Scroll down to the footer 3. Click any social icon (X, GitHub, Discord, YouTube, TikTok, or Instagram) 4. Observe that the link opens in the same tab and navigates away from supabase.com

Fixing Code Block

const socialLinks = [ { href: "https://twitter.com/supabase", label: "X" }, { href: "https://github.com/supabase", label: "GitHub" }, { href: "https://discord.supabase.com", label: "Discord" }, { href: "https://youtube.com/c/supabase", label: "YouTube" }, { href: "https://tiktok.com/@supabase", label: "TikTok" }, { href: "https://instagram.com/supabase", label: "Instagram" } ]; return socialLinks.map((link) => ( <a key={link.href} href={link.href} target="_blank" rel="noopener noreferrer"> {link.label} </a> ));
Add the target="_blank" attribute to each social link anchor so that the link opens in a new browser tab. Include rel="noopener noreferrer" to prevent the newly opened page from accessing window.opener, which mitigates reverse tabnabbing and protects the original Supabase page's context.

Edge Case Audit

rel="noopener noreferrer" is widely supported in modern browsers; however, very old browsers may not recognize the rel attribute, but modern use is safe. Some in-app webviews (e.g., embedded mobile browsers) may ignore target="_blank" and still navigate in the same view, so testing is recommended. No concurrency or multithreading issues exist. To roll back, simply remove the target and rel attributes from the anchors. Ensure the fix is applied to all social link instances in the footer to avoid inconsistent behavior.

Related Intelligence

medium文档缺少对重定向URL中code参数的处理说明，导致用户无法完成OAuth登录mediumnext/image in dev does not update local image after file edit with same filenamemediumMetadata descriptions with Windows carriage returns cause duplicate <meta> tags during hydrationmediumPages Router hydration causes an extra client render on full page load when any rewrite is configured, including non-rewritten routesmediumMissing preload hint for CSS chunks in Next.js App Routermediumedge_runtime.secrets are not propagated when supabase config push is run

Ecosystem Topology

Latest critical and high reports

Agent Frameworks

LangChain, LlamaIndex, and Pydantic

LangChainLlamaIndexPydantic
  1. highStructured output fails when appending assistant response as JSON in multi-turn conversation
  2. highcore: _convert_openai_format_to_data_block hard-codes mime_type on base64 file blocks
  3. highMCP Apps UI resources are silently converted to plain text, losing structure and interactivity
  4. highDuplicate tool_calls in content_blocks when using OpenAI Responses API streaming
  5. highcreate_agent with ProviderStrategy binds empty tools list and breaks OpenAI-compatible providers