How is security handled for testing and unstable?
The short answer is: it’s not. Testing and unstable are rapidly moving targets and the security team does not have the resources needed to properly support those. If you want to have a secure (and stable) server you are strongly encouraged to stay with stable. However, as a matter of fact, unstable usually gets fixed really quick since security updates sometimes get they are usually available upstream faster (other versions, like those in stable need usually to be backported).
