fix: xss in removeContacts