Doing a bit more research, it looks like my info is out of date. There used to be a warning about it on the Debian website (I think that's where I originally got the admonition that testing may have security gaps), but the current website actually says that it is security-managed, with security.debian.org uploads done in cases where migration from unstable is held up: http://www.debian.org/security/faq#testing

Sorry for the misinformation!

Thanks for the pointer!

I just found from your link that I had no security repo configured. Just added:

deb http://security.debian.org testing/updates main

UPDATE: Here is a more correct set of settings from http://secure-testing-master.debian.net/ :

deb http://security.debian.org testing/updates main contrib non-free

deb-src http://security.debian.org testing/updates main contrib non-free

Even though they claim that contrib and non-free have no security updates, they are listed for some reason.