Quoting from https://lists.debian.org/debian-devel-announce/2019/07/msg00004.html:
| over the last years we had people getting confused over <suite>-updates
| (recommended updates) and <suite>/updates (security updates). Starting
| with Debian 11 "bullseye" we have therefore renamed the suite including
| the security updates to <suite>-security.
|
| An entry in sources.list should look like
|
| deb http://security.debian.org/debian-security bullseye-security main
|
| For previous releases the name will not change.
# add security.debian.org:
case "$RELEASE" in
unstable|sid|lenny) ;; # no security pool available
# add security.debian.org:
case "$RELEASE" in
unstable|sid|lenny) ;; # no security pool available
+ squeeze|wheezy|jessie|stretch|buster)
echo "Adding security.debian.org to sources.list."
echo "deb http://security.debian.org ${RELEASE}/updates $COMPONENTS" >> /etc/apt/sources.list
;;
echo "Adding security.debian.org to sources.list."
echo "deb http://security.debian.org ${RELEASE}/updates $COMPONENTS" >> /etc/apt/sources.list
;;
+ *)
+ # bullseye and newer releases use a different repository layout, see
+ # https://lists.debian.org/debian-devel-announce/2019/07/msg00004.html
+ echo "Adding security.debian.org/debian-security to sources.list."
+ echo "deb http://security.debian.org/debian-security ${RELEASE}-security $COMPONENTS" >> /etc/apt/sources.list
+ ;;