diff --git a/epic-games.js b/epic-games.js
index 4ce8b9a..3077fd7 100644
--- a/epic-games.js
+++ b/epic-games.js
@@ -2,7 +2,7 @@ import { firefox } from 'playwright'; // stealth plugin needs no outdated playwr
 import { authenticator } from 'otplib';
 import path from 'path';
 import { existsSync, writeFileSync } from 'fs';
-import { dirs, jsonDb, datetime, stealth, filenamify, notify } from './util.js';
+import { dirs, jsonDb, datetime, stealth, filenamify, notify, html_game_list } from './util.js';
 import { cfg } from './config.js';
 
 import prompts from 'prompts'; // alternatives: enquirer, inquirer
@@ -131,7 +131,7 @@ try {
     const game_id = page.url().split('/').pop();
     db.data[user][game_id] ||= { title, time: datetime(), url: page.url() }; // this will be set on the initial run only!
     console.log('Current free game:', title);
-    const notify_game = {title, url, status: 'failed'};
+    const notify_game = { title, url, status: 'failed' };
     notify_games.push(notify_game); // status is updated below
 
     if (btnText.toLowerCase() == 'in library') {
@@ -199,8 +199,7 @@ try {
 } finally {
   await db.write(); // write out json db
   if (notify_games.filter(g => g.status != 'existed').length) { // don't notify if all were already claimed; TODO don't notify if killed?
-    const list = notify_games.map(g => `- <a href="${g.url}">${g.title}</a> (${g.status})`).join('<br>');
-    notify(`epic-games:<br>${list}`);
+    notify(`epic-games:<br>${html_game_list(notify_games)}`);
   }
 }
 await writeFileSync(path.resolve(dirs.browser, 'cookies.json'), JSON.stringify(await context.cookies()));
diff --git a/gog.js b/gog.js
index 51722b3..685fcfa 100644
--- a/gog.js
+++ b/gog.js
@@ -1,6 +1,6 @@
 import { firefox } from 'playwright'; // stealth plugin needs no outdated playwright-extra
 import path from 'path';
-import { dirs, jsonDb, datetime, filenamify, notify } from './util.js';
+import { dirs, jsonDb, datetime, filenamify, notify, html_game_list } from './util.js';
 import { cfg } from './config.js';
 
 import prompts from 'prompts'; // alternatives: enquirer, inquirer
@@ -127,8 +127,7 @@ try {
 } finally {
   await db.write(); // write out json db
   if (notify_games.filter(g => g.status != 'existed').length) { // don't notify if all were already claimed; TODO don't notify if killed?
-    const list = notify_games.map(g => `- <a href="${g.url}">${g.title}</a> (${g.status})`).join('<br>');
-    notify(`gog:<br>${list}`);
+    notify(`gog:<br>${html_game_list(notify_games)}`);
   }
 }
 await context.close();
diff --git a/prime-gaming.js b/prime-gaming.js
index b45e556..66e7c82 100644
--- a/prime-gaming.js
+++ b/prime-gaming.js
@@ -1,7 +1,7 @@
 import { firefox } from 'playwright'; // stealth plugin needs no outdated playwright-extra
 import { authenticator } from 'otplib';
 import path from 'path';
-import { dirs, jsonDb, datetime, stealth, filenamify, notify } from './util.js';
+import { dirs, jsonDb, datetime, stealth, filenamify, notify, html_game_list } from './util.js';
 import { cfg } from './config.js';
 
 import prompts from 'prompts'; // alternatives: enquirer, inquirer
@@ -139,7 +139,7 @@ try {
     console.log('  External store:', store);
     const url = page.url().split('?')[0];
     db.data[user][title] ||= { title, time: datetime(), url, store };
-    const notify_game = {title, url, status: `failed - link ${store}`};
+    const notify_game = { title, url, status: `failed - link ${store}` };
     notify_games.push(notify_game); // status is updated below
     if (await page.locator('div:has-text("Link game account")').count()) {
       console.error('  Account linking is required to claim this offer!');
@@ -182,8 +182,7 @@ try {
 } finally {
   await db.write(); // write out json db
   if (notify_games.length) { // list should only include claimed games
-    const list = notify_games.map(g => `- <a href="${g.url}">${g.title}</a> (${g.status})`).join('<br>');
-    notify(`prime-gaming:<br>${list}`);
+    notify(`prime-gaming:<br>${html_game_list(notify_games)}`);
   }
 }
 await context.close();
diff --git a/util.js b/util.js
index fb86c12..47d1134 100644
--- a/util.js
+++ b/util.js
@@ -95,3 +95,7 @@ export const notify = (html) => {
     if (stdout) console.log(`stdout: ${stdout}`);
   });
 }
+
+export const escapeHtml = (unsafe) => unsafe.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
+
+export const html_game_list = games => games.map(g => `- <a href="${g.url}">${escapeHtml(g.title)}</a> (${g.status})`).join('<br>');