diff --git a/src/lib/components/Checklist.svelte b/src/lib/components/Checklist.svelte
index 070487f..5021589 100644
--- a/src/lib/components/Checklist.svelte
+++ b/src/lib/components/Checklist.svelte
@@ -183,7 +183,7 @@
 
 	function handlePaste(e: ClipboardEvent) {
 		e.preventDefault();
-		const text = e.clipboardData?.getData('text/plain') ?? '';
+		const text = (e.clipboardData?.getData('text/plain') ?? '').replace(/[\r\n]+/g, ' ');
 		const selection = window.getSelection();
 		if (!selection?.rangeCount) return;
 		const range = selection.getRangeAt(0);
@@ -327,6 +327,7 @@
 					onblur={(e) => { (e.target as HTMLElement).innerHTML = linkifyText(item.text); }}
 					class="flex-1 min-w-0 bg-transparent text-sm outline-none break-words {item.checked ? 'text-[var(--text-muted)] line-through' : 'text-[var(--text)]'}"
 					data-placeholder="List item"
+					aria-placeholder="List item"
 					data-testid="checklist-input"
 					data-item-id={item.id}
 					role="textbox"
diff --git a/src/lib/components/LinkPopover.svelte b/src/lib/components/LinkPopover.svelte
index 88fd46e..9ee5063 100644
--- a/src/lib/components/LinkPopover.svelte
+++ b/src/lib/components/LinkPopover.svelte
@@ -52,7 +52,7 @@
 	}
 </script>
 
-<svelte:window onclick={handleClickOutside} onkeydown={handleKeydown} />
+<svelte:window onclick={handleClickOutside} onkeydown={handleKeydown} onscroll={onClose} onresize={onClose} />
 
 <!-- svelte-ignore a11y_no_static_element_interactions -->
 <div
diff --git a/src/lib/components/NoteCard.svelte b/src/lib/components/NoteCard.svelte
index 0a3ccad..291cc53 100644
--- a/src/lib/components/NoteCard.svelte
+++ b/src/lib/components/NoteCard.svelte
@@ -134,7 +134,8 @@
 	{#if note.checklistMode && checklistItems.length > 0}
 		<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
 		<ul class="space-y-2 mb-6" data-testid="note-checklist-preview"
-			onclick={(e) => { if ((e.target as HTMLElement).closest('a')) e.stopPropagation(); }}>
+			onclick={(e) => { if ((e.target as HTMLElement).closest('a')) e.stopPropagation(); }}
+			onkeydown={(e) => { if ((e.target as HTMLElement).closest('a')) e.stopPropagation(); }}>
 			{#each sortedChecklistItems.slice(0, 8) as item}
 				<li class="flex items-start gap-2 text-sm {item.indented ? 'pl-4 ' : ''}{item.checked ? 'text-[var(--text-muted)] line-through' : 'text-[var(--text)]'}"
 					data-testid={item.indented ? 'card-checklist-child' : undefined}>
diff --git a/src/lib/utils/checklist.test.ts b/src/lib/utils/checklist.test.ts
index d4d5e14..f60fbec 100644
--- a/src/lib/utils/checklist.test.ts
+++ b/src/lib/utils/checklist.test.ts
@@ -224,19 +224,19 @@ describe('outdentItem', () => {
 describe('linkifyText', () => {
 	it('converts https URLs to anchor tags', () => {
 		expect(linkifyText('visit https://example.com today')).toBe(
-			'visit <a href="https://example.com" target="_blank" rel="noopener" class="checklist-link">https://example.com</a> today'
+			'visit <a href="https://example.com" target="_blank" rel="noopener noreferrer" class="checklist-link">https://example.com</a> today'
 		);
 	});
 
 	it('converts http URLs to anchor tags', () => {
 		expect(linkifyText('go to http://example.com')).toBe(
-			'go to <a href="http://example.com" target="_blank" rel="noopener" class="checklist-link">http://example.com</a>'
+			'go to <a href="http://example.com" target="_blank" rel="noopener noreferrer" class="checklist-link">http://example.com</a>'
 		);
 	});
 
 	it('converts bare www URLs with https href', () => {
 		expect(linkifyText('check www.example.com')).toBe(
-			'check <a href="https://www.example.com" target="_blank" rel="noopener" class="checklist-link">www.example.com</a>'
+			'check <a href="https://www.example.com" target="_blank" rel="noopener noreferrer" class="checklist-link">www.example.com</a>'
 		);
 	});
 
@@ -281,7 +281,7 @@ describe('linkifyText', () => {
 
 	it('strips trailing punctuation from URLs', () => {
 		expect(linkifyText('see https://example.com.')).toBe(
-			'see <a href="https://example.com" target="_blank" rel="noopener" class="checklist-link">https://example.com</a>.'
+			'see <a href="https://example.com" target="_blank" rel="noopener noreferrer" class="checklist-link">https://example.com</a>.'
 		);
 	});
 
diff --git a/src/lib/utils/checklist.ts b/src/lib/utils/checklist.ts
index 2f51a48..a10eddc 100644
--- a/src/lib/utils/checklist.ts
+++ b/src/lib/utils/checklist.ts
@@ -180,7 +180,7 @@ export function linkifyText(text: string): string {
 	let lastIndex = 0;
 	for (const { index, match, href } of matches) {
 		result += escapeHtml(text.slice(lastIndex, index));
-		result += `<a href="${escapeHtml(href)}" target="_blank" rel="noopener" class="checklist-link">${escapeHtml(match)}</a>`;
+		result += `<a href="${escapeHtml(href)}" target="_blank" rel="noopener noreferrer" class="checklist-link">${escapeHtml(match)}</a>`;
 		lastIndex = index + match.length;
 	}
 	result += escapeHtml(text.slice(lastIndex));
diff --git a/static/api/openapi.json b/static/api/openapi.json
index 55bf71a..7f8e5d1 100644
--- a/static/api/openapi.json
+++ b/static/api/openapi.json
@@ -3,7 +3,7 @@
   "info": {
     "title": "Crumbs API",
     "description": "Auto-generated API spec for crumbs",
-    "version": "0.24.0",
+    "version": "0.27.1",
     "contact": {
       "name": "Bretzel",
       "url": "https://bretzel.app"