Last month, we announced that security alert notifications were changing to an opt-in model. We have completed this change and users now receive notifications only for repositories they watch and have selected to receive All Activity or configured Custom to include Security alerts.

Watching control with new security alerts setting