What about cyrus-sasl?

[Jan Parcel]

3 questions:

1. Apparently, from the mail about all the great things planned for 
2015, "Cyrus" means cyrus-imap?  Is this alias also for cyrus-sasl 
development?  If not, is there another?

2. For either of the projects,  where can we send notification and 
patches for   possible or probable vulnerabilities?  Especially if we 
don't have time to prove there are exploits
for a particular buffer overflow or NULL dereference?

3.  When I go to look for the "latest" code, I see a red "HEAD" button 
and a green "master" button.
   Should I pull from one of those if I want to  see what's available 
(read-only)   or
     Which should I pull from if I want to contribute (eventually I'll 
have bug fixes.)

Thanks!