I noticed a Reddit thread
(https://www.reddit.com/r/debian/comments/1tgi10a/houston_we_have_a_problem/)
where a user ended up adding stable-security to a bookworm installation
after reading
https://security.debian.org/debian-security/README.security.  At the time of writing, bookworm is oldstable, so this didn't go so well.

This could be improved.  We could perhaps say something like:


If you are using apt you can use this entry in /etc/apt/sources.list,
replacing "<codename>" with the codename of the Debian release you're
using (e.g. trixie):

  deb http://security.debian.org/debian-security <codename>-security main


We could also consider advising people to use the newer deb822 format
instead.

Thanks,