react-doctor/jsx-no-target-blank

Add rel="noreferrer" (or "noopener") whenever using target="_blank".

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires on an <a> (or <form> when forms:true, plus any configured linkComponents/formComponents) whose target resolves to "_blank" (case-insensitive, including ternary branches) while its href/action is external: contains "//": or dynamic, and its rel attribute does not include "noreferrer" (or "noopener"/"noreferrer" when allowReferrer:true). A literal internal/relative href without "//" (e.g. href="/path") does NOT trigger by default, and the static check excludes dynamic links only under enforceDynamicLinks:"never". Note that a non-string rel: bare identifier, function call (rel={getRel()}), or non-string literal (rel={true}, rel={3}, rel={null}): is treated as UNSAFE and IS flagged when paired with an external/dynamic href. Non-trigger: an <a target="_blank"> with NO href (e.g. rel={relValue} alone) is not flagged regardless of rel, since the rule only reports when the link's href/action is external or dynamic.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Add rel="noreferrer" alongside target="_blank" to stop the new tab from accessing window.opener and leaking the referrer: <a href="https://x.com" target="_blank" rel="noreferrer">. Use "noopener noreferrer" for older-browser coverage, or "noopener" only if allowReferrer is enabled and you intentionally keep the referrer. A dynamic rel (variable, function call, or non-string literal) does not satisfy the rule: pass a string literal that contains noreferrer, and for conditional links ensure every ternary branch that yields "_blank" also yields a rel containing noreferrer. See https://oxc.rs/docs/guide/usage/linter/rules/react/jsx-no-target-blank

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.