diff --git a/scripts/security-scan.sh b/scripts/security-scan.sh
index 5df5def..6303ee7 100755
--- a/scripts/security-scan.sh
+++ b/scripts/security-scan.sh
@@ -8,18 +8,40 @@
 # Env felülírások:
 #   SECURITY_SCAN_LOG           — log fájl útvonala
 #   SECURITY_SCAN_CPU_THRESHOLD — CPU% határ (alap 200)
+#   SECURITY_SCAN_NTFY_TOPIC    — ntfy topic (alap st_security)
+#   SECURITY_SCAN_NTFY_CRED     — ntfy credential fájl (alap /etc/ntfy/credentials/auth.env)
 
 set -uo pipefail
 
 LOG="${SECURITY_SCAN_LOG:-/home/sadmin/websitedev/security-scan.log}"
 CPU_THRESHOLD="${SECURITY_SCAN_CPU_THRESHOLD:-200}"
+NTFY_TOPIC="${SECURITY_SCAN_NTFY_TOPIC:-st_security}"
+NTFY_CRED="${SECURITY_SCAN_NTFY_CRED:-/etc/ntfy/credentials/auth.env}"
+NTFY_URL="${SECURITY_SCAN_NTFY_URL:-http://127.0.0.1:2586}"
 FINDINGS=0
+ALERTS=""
 
 alert() {
   printf '[%s] %s\n' "$(date '+%F %T')" "$*" | tee -a "$LOG" >&2
+  ALERTS="${ALERTS}${*}\n"
   FINDINGS=$((FINDINGS + 1))
 }
 
+# ntfy push — a helyi ntfy szerverre (127.0.0.1:2586), az si_17t_pro user
+# tokenjével (a credential fájlból, sosem kerül kimenetre).
+notify() {
+  [ -f "$NTFY_CRED" ] || return 0
+  local token
+  token="$(grep '^NTFY_SI_TOKEN=' "$NTFY_CRED" 2>/dev/null | cut -d= -f2- | tr -d '"' | tr -d '[:space:]')"
+  [ -n "$token" ] || return 0
+  curl -s -o /dev/null --max-time 10 \
+    -H "Authorization: Bearer $token" \
+    -H "Title: mozdIT biztonsági riasztás" \
+    -H "Priority: high" \
+    -d "🛡 mozdIT monitoring: ${FINDINGS} eltérés — $(date '+%F %T')" \
+    "$NTFY_URL/$NTFY_TOPIC" || true
+}
+
 printf '[%s] scan start\n' "$(date '+%F %T')" >> "$LOG"
 
 # 1) Hoszt: álcázott / ismert miner folyamatnevek
@@ -54,5 +76,8 @@ HOST_ARTS="$(ls /tmp/.kworkerd /tmp/.redis-server.pid 2>/dev/null || true)"
 [ -n "$HOST_ARTS" ] && alert "HOST /tmp artifacts: $(printf '%s ' $HOST_ARTS)"
 
 printf '[%s] scan end (findings=%d)\n' "$(date '+%F %T')" "$FINDINGS" >> "$LOG"
-[ "$FINDINGS" -eq 0 ] && exit 0
-exit 1
+if [ "$FINDINGS" -gt 0 ]; then
+  notify
+  exit 1
+fi
+exit 0