Redmine

I think the "Administration" page must not have such a setting. It can be abused by a malicious admin.

But I think adding a setting to turn off security notifications in config/configuration.yml is OK because only a few people can touch the file and those who can update the file and restart Redmine have many other ways to disable security notifications such as changing SMTP settings and modifying the source code of Redmine.

My idea of the configuration to control security notification is like this:

diff --git a/config/configuration.yml.example b/config/configuration.yml.example
index a8b6be83c..563b68f9f 100644
--- a/config/configuration.yml.example
+++ b/config/configuration.yml.example
@@ -175,6 +175,15 @@ default:
   #sudo_mode: true
   #sudo_mode_timeout: 15

+  # Sends a security notification when security-related things are changed.
+  # A user receives notifications when security-related changes are made to
+  # their account (e.g. password or email address).
+  # Admins receives notifications about security-related global settings or
+  # addition/removal of other admins.
+  # Enabled by default.
+  #
+  #security_notification: true
+
   # Absolute path (e.g. /usr/bin/convert, c:/im/convert.exe) to
   # the ImageMagick's `convert` binary. Used to generate attachment thumbnails.
   #imagemagick_convert_command: