Normally, packages go into testing after having been in sid for some time. Is there an exception that allows security updates to be rushed through, or should these be manually gathered from sid?