Report vulnerabilities privately through GitHub's Report a vulnerability form, not a public issue. Expect a first reply within a week.

Only the latest published version of each @toonstrip/* package gets fixes.