Reply ids, which double as the proxy's run id, are now the same base36 ms
timestamp followed by a dash and 128 random bits from crypto.getRandomValues,
so a run can't be found by guessing. Saved replies keep their fields and the
timestamp prefix. The id is sent inside begin, resume and stop instead of the
URL, and SECURITY.md now says ntfy pings carry only the timestamp half.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>