I used to run Debian testing on my servers. These days I don’t have much free time to mess with them, so they’re all running the stable release with unattended-upgrades.
However, mind that it’s not supported and they do not pay attention to security fixes.
To be clear, it can still get security updates, but it’s the package maintainer’s responsibility to upload them. Some maintainers are very responsive while others take a while. On the other hand, Debian stable has a security team that quickly uploads patches to all officially supported packages (just the “main” repo, not contrib, non-free, or non-free-firmware).