VanillaOS is now accepting donations

It is hard to see how the explicit goal of not receiving updates too early is reconciled with the goal of not sacrificing security. Shouldn't there be no such thing as "too early" when it comes to security updates?