Improved notifications to prevent XSS