# Security: User-Scoped Live Notifications

Published 2026-11-02

> Core notification and activity-log subscriptions now use the signed-in user’s identity.

![core-subscription-access.png](https://officenext.erxes.io/gateway/read-file?key=office-erxes-io%2F2zPKa4gsqZWRrlvzQb9rNcore-subscription-access.png)

Live notification and activity-log subscriptions now use the authenticated user on the connection to determine which events to deliver. They no longer rely on a user ID supplied by the subscriber.

Core subscriptions also require sign-in. This change applies to these core event streams; it does not claim the same protection for every plugin subscription.

Available in erxes v3.4.7, released October 29, 2026.