It looks like the code to mail security@ when bugs leave or enter security groups has the wrong group name for the "release track" security bugs https://github.com/mozilla/webtools-bmo-bugzilla/blob/04b55ee366685963928fe37268cc9d99e5477a18/extensions/BMO/lib/Data.pm#L166 I don't know if the above is the official latest copy of what's on BMO, but that version shows "release-core-security" instead of "core-security-release". The latter is correct (yes, it's opposite from all the other *-core-security names to make certain queries easier).
To ssh://firstname.lastname@example.org/webtools/bmo/bugzilla.git 923afd7..87c32cb master -> master
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.