fix: add noopener to window.open fallback in saveImage

packages/web/src/utils/imageActions.test.ts

@@ -57,7 +57,7 @@ describe('saveImage', () => {
 
     await saveImage('https://media.tenor.com/abc/tenor.gif');
 
-    expect(openSpy).toHaveBeenCalledWith('https://media.tenor.com/abc/tenor.gif', '_blank');
+    expect(openSpy).toHaveBeenCalledWith('https://media.tenor.com/abc/tenor.gif', '_blank', 'noopener');
     expect(mockAddToast).toHaveBeenCalledWith('Opened in new tab', 'info', 3000);
   });
 });

packages/web/src/utils/imageActions.ts

@@ -20,7 +20,7 @@ export async function saveImage(url: string, filename?: string): Promise<void> {
     a.remove();
     URL.revokeObjectURL(blobUrl);
   } catch {
-    window.open(url, '_blank');
+    window.open(url, '_blank', 'noopener');
     useUIStore.getState().addToast('Opened in new tab', 'info', 3000);
   }
 }