axon is a fork of ntfy. Security issues in ntfy-core-inherited code that also affects upstream ntfy should be reported upstream per ntfy's security policy — but when in doubt, report here first.

Primary channel: GitHub private vulnerability reporting on this repository (Security tab → "Report a vulnerability"). This reaches the maintainer (@mptfire) privately and allows coordinated disclosure.

Please include: affected version/commit, component (device/agent channel, MCP, AI layer, web, core), impact, and minimal reproduction steps. Do not open public issues with exploitable details, and strip credentials and private message content from any logs you attach.

Only the latest tagged release and current main receive security fixes.

• The device/agent pairing channel, device config sync, MCP server, and AI layer are axon-specific code — report here, not upstream.
• Treat files, paths, metadata, automation requests, and message content as potentially malicious input.