diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..c5e398c
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-05-22 - Reverse Tabnabbing Vulnerability
+**Vulnerability:** External links with `target="_blank"` allow the opened page to access the `window.opener` object, potentially enabling the new page to redirect the original page (Reverse Tabnabbing).
+**Learning:** Even internal tool links (like "GitHub") can be a vector if the destination is compromised or if it redirects. Always treat `target="_blank"` as unsafe.
+**Prevention:** Enforce `rel="noopener noreferrer"` on all `target="_blank"` links.
diff --git a/js/christmas-sidebar.js b/js/christmas-sidebar.js
index 484fb94..42c71ad 100644
--- a/js/christmas-sidebar.js
+++ b/js/christmas-sidebar.js
@@ -450,7 +450,8 @@ function renderSidebar(elRoot) {
   const footer = el("div", { className: "christmas-footer" }, [
     el("a", {
       href: "https://github.com/AEmotionStudio/ComfyUI-ChristmasTheme",
-      target: "_blank"
+      target: "_blank",
+      rel: "noopener noreferrer"
     }, ["🎁 GitHub"])
   ]);
   const container = el("div", { className: "christmas-sidebar" }, [
diff --git a/src/christmas-sidebar.ts b/src/christmas-sidebar.ts
index 9b931ad..06eec88 100644
--- a/src/christmas-sidebar.ts
+++ b/src/christmas-sidebar.ts
@@ -572,7 +572,8 @@ function renderSidebar(elRoot: HTMLElement): void {
     const footer = el('div', { className: 'christmas-footer' }, [
         el('a', {
             href: "https://github.com/AEmotionStudio/ComfyUI-ChristmasTheme",
-            target: "_blank"
+            target: "_blank",
+            rel: "noopener noreferrer"
         }, ["🎁 GitHub"])
     ]);