We are implementing a change to the default notification settings for security alerts. Previously, if you had permission to view security alerts in a repository, you would receive notifications for that repository as long as your settings allowed for security alert notifications. Starting today, we are moving to a model where you must opt-in to security alert notifications by watching the repository. You will be notified as long as you select All Activity or configure Custom to include Security alerts. You will have 30 days to opt-in to these security alert notifications, or you will stop receiving them.

If you want to continue to receive security alert notifications for all of the repositories that you currently receive them for, you can find a migration experience at the bottom of the watching page. Click Subscribe to security alerts to easily opt-in.

Watching control with new security alerts setting