Account security

Settings → Security. Reaching the page requires confirming your current password, so an unattended session cannot be used to change credentials.

Passwords are hashed with bcrypt, checked against known-breached password lists, and the change endpoint is rate limited. Changing yours sends a notification to your address - if you did not make the change, that email is your warning.

TOTP, from any authenticator app. Enable it under Settings → Security: scan the QR code, confirm a code, and store the recovery codes somewhere that is not the same device as the authenticator.

• Recovery codes are single-use. Regenerating them invalidates every previous code.

• The challenge is rate limited, so codes cannot be brute-forced.

• Enabling, disabling, and regenerating recovery codes each send a notification.

Passkeys - WebAuthn - are supported and are the strongest option available. The private key never leaves your device, there is nothing to type, and they are phishing-resistant in a way TOTP is not: a passkey will not authenticate against a lookalike domain.

Register one under Settings → Security. Register at least two, on different devices, or losing the one device means falling back to your other factors.

Adding or removing a passkey sends a notification.

Security-relevant changes to your account are emailed, not just logged. The point is that an unexpected one is actionable.

Browser sessions are separate from API tokens. Signing out of a browser does not revoke a CLI token, and revoking a CLI token does not sign you out of a browser.

If you think an account is compromised, do all three: change the password, revoke every API token, and revoke every authorized device. Then read the audit log for what happened while it was.

Settings → Profile → Delete account, confirmed with your password.

Deletion is scheduled with a grace period rather than immediate, and can be cancelled during it. You are emailed when it is scheduled, if it is cancelled, and when it completes.