Triaged for Tipsy 2.0 (#57)
Still open. No first-party XSS plugin in 2.0 core (intentionally keeping zero runtime deps / thin core).