I disclosed them responsibly and they were fixed before I published this blog post.

As a Fastmail.fm user, thanks for your work in improving the service by notifying the team of these vulnerabilities.