Feature: Provide a system for sending security release notifications

I am new to the Craft ecosystem and loving it so far. Now that my company has several sites live for clients, my mind has shifted to how we can best maintain these sites. My clients don't have a strong need to keep Craft and plugins up to date with the latest version, but I do think they'd value taking updates that include security fixes.

Coming from the world of Django, I am able to sign up for an email newsletter that sends me notifications releases, including security fixes. I know that other technical resources like Ubuntu have a similar methodology, and that would definitely solve my problem! Even if you did not want to go the way of sending an email newsletter, maybe there could be some sort of indicator in the updates section that easily brings security updates to the forefront.

For now, I have subscribed to receive alerts for all releases on the GitHub repo. In researching this topic, I've also gleaned some other reasonable solutions:

• Install the Sherlock plugin

• Follow Craft on Twitter — they mention any security fixes worth worrying about

The options above certainly do work, but it would be super helpful to get some sort of notification system or stream straight from Craft at some point in the future! Interested to know if this would be helpful for others as well.

No files, tests, or entry points are identified in the issue. Start by clarifying whether the intended outcome is email release notifications or an updates-page security indicator; done would mean a defined security-release notification system with an agreed delivery path.