Hello,
In the README it says the following:
Subscribe to email for security announcement: sonic-security-announce@googlegroups.com
However, that group does not seem to exist - or if it does, it is not public.
See: https://groups.google.com/g/sonic-security-announce