Commons 3.2 release is incorrectly marked as red by the Drupal.org packager

A bit of research and I find that project_release_is_security_update is the likely culprit, being called from project_release_compute_update_status.

Somehow single project releases are being seen as having the taxonomy term for "security release" without actually having been tagged as such, so ANY/ALL packages that contain a project that is inadvertently seen as "security release" are set to be non-secure releases.

This is just an educated guess, I don't know if this is actually the cause.