No changelog for some (all?) security packages on packages.debian.org

The changelog link for at least some packages marked as security seems to
be broken. For example, the changelog for apache2 on this page:

    https://packages.debian.org/stretch/apache2

which links to this:


http://ftp-master.metadata.debian.org/changelogs//main/a/apache2/apache2_2.4.25-3+deb9u2_changelog

...results in a 404. From the little bit of poking around I've done, I
*think* this is broken for all packages tagged "security". It would be
really great to get this fixed if possible, since it's especially handy to
be able to look at the changelog for security packages.