secpick should detect whether you are in CE/EE
If you are working on a security issue in EE and run bin/secpick it should try to use the security-XX-Y-ee instead of the security-XX-Y branch.
It fails currently:
bin/secpick -v 11.2 -b "security-11-2-foobar" -s HASH
fatal: Couldn't find remote ref security-11-2
fatal: The remote end hung up unexpectedly