A default XStreamSerializer is used for events, without specifying the security context

I think this is my root problem. have a Repo to reproduce it . see : Axon MongoDB Extension with Jackson Snapshot configuration