CBP-135 follow-up: metadataBase, JSON-LD, H1 fixes, alt-text fixes

[raineer24]

This is a follow-up to the SEO work from PR #604. It closes out the 3 items that were left over: a missing site-address setting, headings that were confusing search engines, and images with meaningless descriptions.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
codebility-plus-codebility-portal	Ready	Preview	Aug 18, 2026 12:01pm

[deocagunot]

Nice work Raineer — this covers all three gaps from the follow-up: metadataBase is set, the JSON-LD is factored into one shared component instead of being copy-pasted per page, and the alt-text fixes are clean. Sorry for the slow review on my end.

One blocker before I can merge.

🔴 Stored XSS in JsonLd.tsx

app/(marketing)/_components/JsonLd.tsx:7-9:

// JSON.stringify is safe here — schema.org data is server-generated,
// not raw user input, so no XSS risk via this dangerouslySetInnerHTML.
dangerouslySetInnerHTML={{ __html: JSON.stringify(data) }}

The comment isn't right — the data is user input on the profile pages. profiles/[id]/page.tsx:78-83 passes straight through:

name: `${codev.first_name} ${codev.last_name}`,
jobTitle: codev.display_position || codev.positions?.[0] || undefined,
description: codev.about || undefined,
sameAs: [codev.github, codev.linkedin, codev.portfolio_website].filter(Boolean),

Every one of those is self-editable in account settings. JSON.stringify escapes quotes but not <, so an About field containing </script><script>alert(1)</script> breaks out of the script tag and executes — on a public page that doesn't need a login. Same exposure through careers/_components/JobListings.tsx:171 and services/page.tsx:123. Only the two schemas in layout.tsx are safe, since those are hardcoded.

Fix:

dangerouslySetInnerHTML={{ __html: JSON.stringify(data).replace(/</g, "\\u003c") }}

< is valid JSON and parses back to <, so the schema still validates in Google's Rich Results tool. Please drop the "no XSS risk" comment too so nobody relies on it later.

🟡 My spec pointed you at a dead file

This one's on me. I named LandingWhyChoose.tsx in the spec, but that file isn't imported anywhere — the homepage actually renders LandingWhyChoose-us.tsx. Your change is correct, it just doesn't affect anything live. The homepage still has 2 h1s, from AnimatedAdminsSection.tsx:20 and LandingInternSection.tsx:12.

Don't fix that here — I've written it up as a separate heading-cleanup task and I'll send it over.

🟢 Not yours, just noting it

/og-image.jpg doesn't exist in public/, and neither do the favicons declared in layout.tsx:46-50. Ironically your metadataBase fix is what made these resolve properly — straight to a 404, so link previews stay blank. That needs design to produce the assets, so I'm tracking it separately.

---

Once the escaping fix is in I'm happy to re-review and merge.

[raineer24]

@deocagunot Fixed and pushed (fcda0c6). Ready for re-review.