Harden external-link handling and disable production source map exposure

[Copilot]

This PR addresses security hardening in the web surfaces by removing production source exposure and closing reverse-tabnabbing gaps on external links opened in new tabs.

• Production source exposure

  • Set productionBrowserSourceMaps to false in apps/www/next.config.ts to prevent shipping browser-readable source maps in production builds.

• External link hardening (target="_blank")

  • Added rel="noopener noreferrer" to _blank links across affected app and kit components:
    • apps/www/app/(app)/{page,mist/page,veil/page,mist-section}.tsx
    • apps/www/app/(discover)/components/filter-panel.tsx
    • apps/www/components/{site-header,site-footer,marketing/illustrations,marketing/wall-of-love}.tsx
    • packages/dusk-kit/blocks/content/six/index.tsx
  • Normalized attributes where legacy rel="noreferrer" already existed to avoid duplicate rel props.

• Representative change

  <Link href={testimonial.link} target="_blank" rel="noopener noreferrer">
    {testimonial.name}
  </Link>

• • https://github.com/user-attachments/assets/747fee4f-147c-48ba-b47b-745de30d3232

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• fonts.googleapis.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/blocks/blocks/apps/www/node_modules/.bin/../next/dist/bin/next build (dns block)
  • Triggering command: /opt/hostedtoolcache/node/24.14.0/x64/bin/node /opt/hostedtoolcache/node/24.14.0/x64/bin/node /home/REDACTED/work/blocks/blocks/node_modules/.pnpm/next@16.1.6_@babel+core@7.27.1_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/start-server.js (dns block)
• pro.tailark.com
  • Triggering command: /opt/hostedtoolcache/node/24.14.0/x64/bin/node /opt/hostedtoolcache/node/24.14.0/x64/bin/node /home/REDACTED/work/blocks/blocks/node_modules/.pnpm/next@16.1.6_@babel+core@7.27.1_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/start-server.js (dns block)
• res.cloudinary.com
  • Triggering command: /opt/hostedtoolcache/node/24.14.0/x64/bin/node /opt/hostedtoolcache/node/24.14.0/x64/bin/node /home/REDACTED/work/blocks/blocks/node_modules/.pnpm/next@16.1.6_@babel+core@7.27.1_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/start-server.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tailark-blocks	Ready	Preview, Comment	Mar 12, 2026 6:43am