2.x gets security fixes. 1.x gets fixes for critical security problems for six months after 2.0.0 is released. Please check that you're on the latest release of your line before reporting.

Please don't open a public issue for a security problem. Report it privately through GitHub's vulnerability reporting instead.

A good report includes the module and Nuxt versions, the steps to reproduce, and what an attacker could do with the issue.