[existentialmutt]

Where do you guys find out about security vulnerabilities?

[ontoillogical]

(I'm the other person responsible for gemcanary)

Having a record of all the security vulnerabilities that affect the Ruby community is important. To that end, we help maintain https://github.com/rubysec/ruby-advisory-db/ which is free for anyone to use or contribute to.