personally I recommend debian "rolling testing" (rather than pinning to a specific release name) with security updates from sid. this prevents all but the most subtle bugs from reaching you and you still get the new hotness within a few weeks of sid. there is a release freeze for a few months prior to the each stable release, but I've had no major issues from that.

the other subtlety is that security updates come later to testing than they do to either stable or sid, but this can be mitigated: https://gist.github.com/khimaros/21db936fa7885360f7bfe7f116b...