Security Notifications

Security notification event types are registered but intentionally conservative.

Registered events:

• security.sensitive_action_requested
• security.email_changed

The starter does not emit these by default because sensitive-action verification and Better Auth account mutations already have dedicated flows. Wire these events only where the user-facing signal is useful and avoid storing secrets, tokens, verification codes, password hashes, or raw provider payloads in notification metadata.