diff --git a/renderer/app.js b/renderer/app.js
index 7e4b40a..124e85f 100644
--- a/renderer/app.js
+++ b/renderer/app.js
@@ -2156,7 +2156,7 @@ function renderSettings() {
       </div>
       <div class="settings-row">
         <label>API-Token</label>
-        <input type="text" class="key-input" id="remoteTokenInput" value="${remoteSettings.token || ''}" readonly style="flex:1">
+        <input type="text" class="key-input" id="remoteTokenInput" value="${escapeAttr(remoteSettings.token || '')}" readonly style="flex:1">
         <button class="btn btn-xs btn-secondary" id="remoteCopyTokenBtn" title="Kopieren">Kopieren</button>
         <button class="btn btn-xs btn-secondary" id="remoteRegenerateTokenBtn" title="Neu generieren">Neu</button>
       </div>