Your recommendation for production hardening describes subscribing to the mailing list (Google Group) that is now phased out. Shouldn’t you be updating the page with the Discussion forum?
And regarding the security updates, wouldn’t it be possible to have a separate thread/tag that is only used for the security updates/announcements?
The Vault mailing list mentioned in the guide (https://groups.google.com/g/vault-tool) is being transitioned to an announce-only list for new Vault releases. Security updates are featured in the announcements of new Vault versions. It will still be the best place to get information about when a release happens and whether it contains security content.
I’ve created a PR to add a reference to Discuss to the production hardening guide. I do think that if you’re only interested in security updates and new releases, the mailing list is the best place to get those updates.