Out-of-App Security / Critical Update Notice Notification Channel(s)

Self-host operators (pass notwithstanding) have limited options for being notified of critical security fixes or other time-sensitive updates to Fluxer that need to be applied to their infrastructure. This could contribute to unnecessarily lengthening time for admins to patch existing deployments, risking their users' privacy and security. While the weekly patch notes, accessible at https://fluxer.com/blog/patch-notes and delivered via RSS https://fluxer.com/blog/rss.xml would contain these notices, they are not focused on 'mandatory' updates so are more likely to be overlooked. Especially for admins who normally delay feature updates to avoid potential new-release bugs, focusing on platform stability. The website requires actively checking on an expected weekly cadence. Not all instance admins will be checking weekly and would not know they need to check in the event of an out-of-cycle security patch note. The RSS feed is not, to the best of my knowledge, advertised as a security channel to follow so instance admins might not be aware of its potential for this use case.

A possible short term mitigation: Calling out the existing RSS feed and patch notes in the Self Host documentation as intended to contain security release notices would help encourage subscriptions to the former and more active checking of the latter. A mid-term solution could be: Creation of a dedicated security release page and/or RSS feed - even if as simple as just a link to the full, regular patch notes with "This includes important notices for self-hosting administrators." In the long term I'd like: Creation of one or more dedicated, off-platform notification channels that informs admins of critical security updates, scope of impact, whether active exploitation has been reported, where to go to learn more, and required actions to mitigate or resolve. Open to suggestions in this regard - mailing list, RSS feed, social media channel, etc.

Ex. Debian (and other projects) have dedicated pages, [email] mailing lists, and RSS feeds that contain security-related notices. https://www.debian.org/security/