We've just added a page detailing CiviCRM's security policy and release process.
https://civicrm.org/securityThis page is intended to help people identify how they can stay abreast of security updates, know when to expect them, and how to tell which release of CiviCRM to expect security fixes for.