Software repositories and vulnerabilities

Since PureOS tracks Debian testing, I’m pretty sure PureOS gets security updates pretty much as soon as they are available in Debian. I might be wrong though.