A note to the side, last I looked at tails they still had the standard policy of not revealing security vulnerabilities until a release could be made.  We've since learned that security vulnerabilities are the primary way of deanonymising people, so hopefully they have a policy of distributing immediate security updates now like most distributions do, but I worry they still might not.