[epmatsw]

There’s also a disown-opener CSP directive that’s hopefully going to be implemented at some point. Should help take care of this.

[madeofpalk]

On the same note, in the JSX plugin for ESLint, there's a rule to warn against target="_blank" without rel="noopener". Very handy.