diff --git a/src/components/Toolbar.jsx b/src/components/Toolbar.jsx
index 9bf7ad68..81550b58 100644
--- a/src/components/Toolbar.jsx
+++ b/src/components/Toolbar.jsx
@@ -32,7 +32,8 @@ function ToolbarLink(props) {
   return <a
     className={classnames('maputnik-toolbar-link', props.className)}
     href={props.href}
-    target={"blank"}
+    rel="noopener noreferrer"
+    target={"_blank"}
   >
     {props.children}
   </a>
diff --git a/src/components/modals/ExportModal.jsx b/src/components/modals/ExportModal.jsx
index fd00a6f9..d711d7ea 100644
--- a/src/components/modals/ExportModal.jsx
+++ b/src/components/modals/ExportModal.jsx
@@ -126,7 +126,7 @@ class Gist extends React.Component {
     const user = gist.user || 'anonymous';
     const preview = !!gist.files['index.html'];
     if(preview) {
-      return <span><a target="_blank" href={"https://bl.ocks.org/"+user+"/"+gist.id}>Preview</a>,{' '}</span>
+      return <span><a target="_blank" rel="noopener noreferrer" href={"https://bl.ocks.org/"+user+"/"+gist.id}>Preview</a>,{' '}</span>
     }
     return null;
   }
@@ -144,7 +144,7 @@ class Gist extends React.Component {
         <p>
           Latest saved gist:{' '}
           {this.renderPreviewLink(this)}
-          <a target="_blank" href={"https://gist.github.com/" + user + "/" + gist.id}>Source</a>
+          <a target="_blank" rel="noopener noreferrer" href={"https://gist.github.com/" + user + "/" + gist.id}>Source</a>
         </p>
         <p>
           <CopyToClipboard text={maputnikStyleLink}>
@@ -177,7 +177,7 @@ class Gist extends React.Component {
                   value={(this.props.mapStyle.metadata || {})['maputnik:openmaptiles_access_token']}
                   onChange={this.changeMetadataProperty.bind(this, "maputnik:openmaptiles_access_token")}/>
             </InputBlock>
-            <a target="_blank" href="https://openmaptiles.com/hosting/">Get your free access token</a>
+            <a target="_blank" rel="noopener noreferrer" href="https://openmaptiles.com/hosting/">Get your free access token</a>
           </div>
       : null}
       {this.renderLatestGist()}